CVE-2026-25749
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In Vim, prior to version 9.1.2132, a heap buffer overflow vulnerability exists in the tag file resolution logic related to the 'helpfile' option. This issue occurs in the get_tagfname() function and involves copying the user-controlled 'helpfile' option value into a fixed-size buffer without bounds checking.
Risk Assessment
This vulnerability could lead to arbitrary code execution, posing a significant security risk to the system. An attacker could exploit this flaw to gain control over the system.
Recommendation
It is recommended to update Vim to version 9.1.2132 or later to mitigate this vulnerability. Additionally, an audit of the use of the 'helpfile' option in existing configurations should be conducted.
Original NVD description (English source)
Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.