Vim - vulnerabilities (CVEs)

264 CVEs in 6 products, 0 in the last 30 days, newest from 2026-08-19.

Products

• Vim - 259 CVEs
• Vimvim - 159 CVEs
• Gvim - 2 CVEs
• Netrw - 1 CVEs
• Tar.vim - 1 CVEs
• Zipplugin.vim - 1 CVEs

Newest CVEs of Vim

• CVE-2026-43961 - CVSS 7.8 (high), 2026-08-19: A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during…
• CVE-2026-73073 - CVSS 7.8 (high), 2026-08-18: Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep…
• CVE-2026-73078 - CVSS 8.8 (high), 2026-08-11: Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and…
• CVE-2026-73077 - CVSS 8.4 (high), 2026-08-11: Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim…
• CVE-2026-73076 - CVSS 8.4 (high), 2026-08-11: Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to…
• CVE-2026-73075 - CVSS 4.6 (medium), 2026-08-11: Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a…
• CVE-2026-73074 - CVSS 7.1 (high), 2026-08-11: Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment…
• CVE-2026-73072 - CVSS 8.5 (high), 2026-08-11: Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by…
• CVE-2026-73071 - CVSS 3.3 (low), 2026-08-11: Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after…
• CVE-2026-73070 - CVSS 6.8 (medium), 2026-08-11: Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in…
• CVE-2026-51401 - CVSS 7.7 (high), 2026-08-04: An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c
• CVE-2026-51400 - CVSS 8.4 (high), 2026-08-04: An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c
• CVE-2026-59856 - CVSS 8.4 (high), 2026-07-09: Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or…
• CVE-2026-59858 - CVSS 8.4 (high), 2026-07-09: Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref:…
• CVE-2026-59857 - CVSS 5.6 (medium), 2026-07-09: Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a…
• CVE-2026-55693 - CVSS 7.8 (high), 2026-06-25: Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a…
• CVE-2026-55892 - CVSS 5.5 (medium), 2026-06-25: Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively…
• CVE-2026-55895 - CVSS 7.8 (high), 2026-06-25: Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw…
• CVE-2026-57451 - CVSS 6.1 (medium), 2026-06-25: Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a…
• CVE-2026-57452 - CVSS 5.5 (medium), 2026-06-25: Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method…
• CVE-2026-57453 - CVSS 7.3 (high), 2026-06-25: Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to…
• CVE-2026-57454 - CVSS 6.8 (medium), 2026-06-25: Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and…
• CVE-2026-57455 - CVSS 7.8 (high), 2026-06-25: Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through…
• CVE-2026-57456 - CVSS 8.4 (high), 2026-06-25: Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy…
• CVE-2026-52860 - CVSS 8 (high), 2026-06-11: Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions…
• CVE-2026-52859 - CVSS 8.2 (high), 2026-06-11: Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal…
• CVE-2026-52858 - CVSS 7.8 (high), 2026-06-11: Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3…
• CVE-2026-47167 - CVSS 5.3 (medium), 2026-06-11: Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype…
• CVE-2026-47162 - CVSS 8.8 (high), 2026-06-11: Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the…
• CVE-2026-46483 - CVSS 7 (high), 2026-05-15: Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim…