Vim vulnerabilities

Vim is an open source command line text editor. Prior to 9.2.0357, a command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion; if it contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Vim is an open-source command-line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.

Vim versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) in the swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file.

Vim, an open-source command-line text editor, prior to version 9.2.0076 contains a heap-based buffer overflow write and an out-of-bounds read in its terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.

Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer.

Vim is vulnerable to a heap-based buffer overflow out-of-bounds read in its Emacs-style tags file parsing logic prior to version 9.2.0074. When processing a malformed tags file, Vim can read up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue.

An OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

A stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command. A malicious NetBeans server can overflow the 64-byte keybuf with a single specialKeys command. The issue is fixed in Vim patch v9.1.2148.

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer passed down to the option callback functions.

Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file.

Vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax', and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.

Vim is an improved version of the Unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. This may lead to the tb_off position within the buffer being out of bounds.

In Vim before 9.1.0764, a use-after-free occurs when closing a buffer and a BufWinLeave auto command reopens the same buffer in a new split window.

A vulnerability in Vim before version 9.2.0272 allows immediate code execution upon opening a crafted file in the default configuration. The issue is due to %{expr} injection in tabpanel lacking the P_MLE flag.

An integer overflow at an unserialize_uep memory allocation site occurs for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

Vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.

Vim's netrw plugin contains a vulnerability that allows arbitrary Vimscript execution via a crafted filename with quote characters and expression fragments. This can lead to shell command execution with the privileges of the user running Vim.

Vim prior to 9.2.0845 has a vulnerability in StructMembers() in runtime/autoload/ccomplete.vim, which constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.

Vim, an open source command line text editor, prior to 9.2.0840 has a vulnerability in runtime/plugin/netrwPlugin.vim and runtime/pack/dist/opt/netrw/autoload/netrw.vim where Bookmarks, History, and Targets menu entries are constructed by interpolating attacker-controlled directory paths into executed :menu commands. Functions s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. The issue is fixed in version 9.2.0840.

In Vim before 9.2.0839, the ftplugin plugins for sh, zsh, and ps1 pass attacker-controlled Visual-mode selections to keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before invoking bash, zsh, or PowerShell, allowing arbitrary OS commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.

In Vim before 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including OS commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.

Vim, an open source command line text editor, from version 9.2.0469 to 9.2.0843 has a vulnerability in popup_mark_opacity_zindex() in src/popupwin.c that can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

In Vim before 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.

In Vim before 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.

Vim, an open source text editor, has a vulnerability in json_decode_item() in src/json.c that can retain a stale pointer after json_decode_string() invokes channel_fill(), causing the error path to read freed memory when an invalid JSON string spans buffers. Affects versions from 9.2.0511 to 9.2.0844, fixed in 9.2.0844.

Vim, an open source command line text editor, prior to version 9.2.0842 has a vulnerability in the socket server backend in src/socketserver.c that accepts unbounded client connections, causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c. A local process that can connect to the server socket can corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.

In Vim Project version 9.2.0389 and earlier, there is an issue in the vms_fixfilename() function in vim/src/os_vms.c that allows a local attacker to execute arbitrary code.

Vim version 9.2.0389 and earlier has a vulnerability that allows a local attacker to execute arbitrary code via the vms_fixfilename() function in file vim/src/os_vms.c.

In Vim prior to 9.2.0735, the C omni-completion script (ccomplete.vim) improperly interpolates the typeref: or typename: field from a tags file into a :vimgrep pattern executed via :execute. This allows injection of arbitrary Ex commands through a crafted .c file and invoking C omni-completion.

In Vim prior to version 9.2.0725, the spell_soundfold_sal() function in src/spell.c has a stack buffer overflow vulnerability. When translating a word through spell file SAL sound-folding rules, insufficient length checking can cause a one-byte write past the end of the buffer, potentially corrupting the stack frame and crashing the editor.

A vulnerability in Vim prior to 9.2.0736 allows arbitrary OS command execution when a victim opens a crafted PHP file and invokes omni-completion. The issue is due to improper escaping of class or trait names in the phpcomplete.vim script, enabling injection of Ex commands including :!.

In Vim prior to version 9.2.0597, the Python omni-completion function executes reconstructed function and class definitions from the current buffer using exec(). Python evaluates default argument values, parameter annotations, and class base expressions at definition time, so a malicious buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation does not cover this path because the attacker-controlled code is not a harvested import/from statement.

In Vim, prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copied the visible terminal screen into the scrollback buffer, which could lead to out-of-bounds array access. As a result, a program rendered inside a :terminal window could trigger a crash.

Vim prior to version 9.2.0561 has a security issue related to executing code from malicious .py files when using Python's omni-completion feature. As a result, malicious code can be run in the context of the editing user.

In Vim prior to version 9.2.0495, a Vimscript code injection vulnerability exists in the s:NetrwBookHistSave() function of the netrw plugin. A directory name from the filesystem is interpolated into a single-quoted Vimscript string without escaping embedded single quotes, allowing arbitrary Vimscript execution, including shell commands, when the history file is sourced.

In Vim prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath.

In Vim prior to version 9.2.0435, an OS command injection vulnerability exists in the :find command-line completion. When the path option contains backtick-enclosed shell commands, they are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing arbitrary command execution when the user opens a file and triggers :find completion.

Vim before version 9.2.0383 has an OS command injection vulnerability in the netrw standard plugin via a crafted URL (e.g., sftp:// or file://). User interaction is required.

Vim prior to version 9.2.0316 has a command injection vulnerability in its netbeans interface. A malicious netbeans server can execute arbitrary Ex commands when Vim connects, via unsanitized strings in defineAnnoType and specialKeys messages.

In Vim, the zip.vim plugin before version 9.2.0280 contains a path traversal bypass that allows overwriting arbitrary files when opening specially crafted zip archives. This vulnerability circumvents the previous fix for CVE-2025-53906.

A vulnerability in Vim prior to version 9.2.0276 allows a modeline sandbox bypass leading to arbitrary OS command execution. The `complete`, `guitabtooltip`, and `printheader` options lack the `P_MLE` flag, and the `mapset()` function is missing a `check_secure()` call, enabling exploitation from sandboxed expressions.

In Vim prior to version 9.2.0202, a command injection vulnerability exists in the glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may execute arbitrary shell commands. This depends on the user's 'shell' setting.

In Vim, the NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in a segmentation fault when estimating match width for look-behind assertions. This vulnerability is fixed in version 9.2.0137.

In Vim, prior to version 9.1.2132, a heap buffer overflow vulnerability exists in the tag file resolution logic related to the 'helpfile' option. This issue occurs in the get_tagfname() function and involves copying the user-controlled 'helpfile' option value into a fixed-size buffer without bounds checking.

Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory of the edited file. When using cmd.exe as a shell, Vim resolves external commands by searching the current working directory before system paths.

A vulnerability in Vim may lead to a heap-buffer overflow when switching to other buffers with visual mode still active. The issue arises from the improper ending of visual mode, which may result in attempts to access memory beyond the end of a line in a buffer.

Vim before v9.1.0648 has a double-free vulnerability in dialog_changed(). When abandoning a buffer, Vim may ask the user what to do. If the buffer had no name and the user chooses to save, Vim creates a new Untitled file, but setting the buffer name leads to a double-free, possibly causing heap-use-after-free and crash.

Vim prior to version 9.0.2121 has a heap-use-after-free vulnerability that can occur when executing the `:s` command for the first time using a sub-replace-special atom. This may lead to unsafe memory access and potential crashes of the Vim editor.

Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer.