CVE-2026-34982

EUVD-2026-19313
Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.2 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.86%
Affected Products (NVD)
VendorProductVersion
vimvim
𝑥
< 9.2.0276
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
2:9.1.083-6.el10_1.4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10
2:9.1.083-9.el10_2.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
2:9.1.083-5.el10_0.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8
2:8.0.1763-22.el8_10.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
2:8.0.1763-15.el8_4.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
2:8.0.1763-15.el8_4.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
2:8.0.1763-19.el8_6.6 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
2:8.0.1763-19.el8_6.6 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
2:8.0.1763-20.el8_8.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
2:8.0.1763-20.el8_8.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
2:8.2.2637-23.el9_7.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
2:8.2.2637-26.el9_8.4 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions
2:8.2.2637-20.el9_2.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions
2:8.2.2637-20.el9_4.3 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
2:8.2.2637-22.el9_6.3 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.2
1782951051 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.2
1782951012 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.2
1782951244 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1782352950 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1782352919 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1782353093 ≤
𝑥
< *
ADP
Red HatRed Hat AI Inference Server 3.3
1782352847 ≤
𝑥
< *
ADP
Red HatRed Hat Insights proxy 1.5
1780420428 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1779798159 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1779798164 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1779798165 ≤
𝑥
< *
ADP
Red HatRed Hat Update Infrastructure 5
1779798222 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
vim
bookworm
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
2:9.2.0858-1
fixed
sid
2:9.2.0858-1
fixed
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
vim
bionic
not-affected
focal
Fixed 2:8.1.2269-1ubuntu5.32+esm3
released
jammy
Fixed 2:8.2.3995-1ubuntu2.27
released
noble
Fixed 2:9.1.0016-1ubuntu7.11
released
questing
Fixed 2:9.1.0967-1ubuntu6.2
released
trusty
not-affected
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
gvim
suse enterprise sap 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise server 12 SP3
9.2.0280-17.62.1
fixed
suse enterprise server 12 SP5
9.2.0280-17.62.1
fixed
suse enterprise server 15 SP4
9.2.0280-150000.5.89.1
fixed
suse enterprise server 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP6
9.2.0280-150500.20.46.1
fixed
vim
suse enterprise desktop 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise server 12 SP3
9.2.0280-17.62.1
fixed
suse enterprise server 12 SP5
9.2.0280-17.62.1
fixed
suse enterprise server 15 SP4
9.2.0280-150000.5.89.1
fixed
suse enterprise server 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP7
9.2.0280-150500.20.46.1
fixed
vim-data
suse enterprise desktop 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise server 12 SP3
9.2.0280-17.62.1
fixed
suse enterprise server 12 SP5
9.2.0280-17.62.1
fixed
suse enterprise server 15 SP4
9.2.0280-150000.5.89.1
fixed
suse enterprise server 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP7
9.2.0280-150500.20.46.1
fixed
vim-data-common
suse enterprise desktop 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise server 12 SP3
9.2.0280-17.62.1
fixed
suse enterprise server 12 SP5
9.2.0280-17.62.1
fixed
suse enterprise server 15 SP4
9.2.0280-150000.5.89.1
fixed
suse enterprise server 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP7
9.2.0280-150500.20.46.1
fixed
vim-small
suse enterprise desktop 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP4
9.2.0280-150000.5.89.1
fixed
suse enterprise server 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP7
9.2.0280-150500.20.46.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
vim-X11
RHEL 8
2:8.0.1763-22.el8_10.3
fixed
RHEL 8.4 AUS
2:8.0.1763-15.el8_4.2
fixed
RHEL 8.6 AUS
2:8.0.1763-19.el8_6.6
fixed
RHEL 8.8 E4S
2:8.0.1763-20.el8_8.2
fixed
RHEL 8.8 TUS
2:8.0.1763-20.el8_8.2
fixed
RHEL 9
2:8.2.2637-26.el9_8.4
fixed
vim-common
RHEL 8
2:8.0.1763-22.el8_10.3
fixed
RHEL 8.4 AUS
2:8.0.1763-15.el8_4.2
fixed
RHEL 8.6 AUS
2:8.0.1763-19.el8_6.6
fixed
RHEL 8.8 E4S
2:8.0.1763-20.el8_8.2
fixed
RHEL 8.8 TUS
2:8.0.1763-20.el8_8.2
fixed
RHEL 9
2:8.2.2637-23.el9_7.3
fixed
vim-enhanced
RHEL 8
2:8.0.1763-22.el8_10.3
fixed
RHEL 8.4 AUS
2:8.0.1763-15.el8_4.2
fixed
RHEL 8.6 AUS
2:8.0.1763-19.el8_6.6
fixed
RHEL 8.8 E4S
2:8.0.1763-20.el8_8.2
fixed
RHEL 8.8 TUS
2:8.0.1763-20.el8_8.2
fixed
RHEL 9
2:8.2.2637-26.el9_8.4
fixed
vim-filesystem
RHEL 8
2:8.0.1763-22.el8_10.3
fixed
RHEL 8.4 AUS
2:8.0.1763-15.el8_4.2
fixed
RHEL 8.6 AUS
2:8.0.1763-19.el8_6.6
fixed
RHEL 8.8 E4S
2:8.0.1763-20.el8_8.2
fixed
RHEL 8.8 TUS
2:8.0.1763-20.el8_8.2
fixed
RHEL 9
2:8.2.2637-23.el9_7.3
fixed
vim-minimal
RHEL 8
2:8.0.1763-22.el8_10.3
fixed
RHEL 8.4 AUS
2:8.0.1763-15.el8_4.2
fixed
RHEL 8.6 AUS
2:8.0.1763-19.el8_6.6
fixed
RHEL 8.8 E4S
2:8.0.1763-20.el8_8.2
fixed
RHEL 8.8 TUS
2:8.0.1763-20.el8_8.2
fixed
RHEL 9
2:8.2.2637-26.el9_8.4
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
vim-X11
Amazon Linux 2
2:9.0.2153-1.amzn2.0.5
fixed
vim-common
Amazon Linux 2
2:9.0.2153-1.amzn2.0.5
fixed
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
vim-data
Amazon Linux 2
2:9.0.2153-1.amzn2.0.5
fixed
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
vim-debuginfo
Amazon Linux 2
2:9.0.2153-1.amzn2.0.5
fixed
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
vim-debugsource
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
vim-default-editor
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
vim-enhanced
Amazon Linux 2
2:9.0.2153-1.amzn2.0.5
fixed
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
vim-enhanced-debuginfo
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
vim-filesystem
Amazon Linux 2
2:9.0.2153-1.amzn2.0.5
fixed
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
vim-minimal
Amazon Linux 2
2:9.0.2153-1.amzn2.0.5
fixed
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
vim-minimal-debuginfo
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
xxd
Amazon Linux 2
2:9.0.2153-1.amzn2.0.5
fixed
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
xxd-debuginfo
Amazon Linux 2023
2:9.2.240-1.amzn2023.0.2
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
vim
Azure Linux 3.0
0:9.2.0315-1.azl3
fixed
Common Weakness Enumeration
References
https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615
https://github.com/vim/vim/releases/tag/v9.2.0276
https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9
http://www.openwall.com/lists/oss-security/2026/04/01/1
https://access.redhat.com/errata/RHSA-2026:11389
https://access.redhat.com/errata/RHSA-2026:11509
https://access.redhat.com/errata/RHSA-2026:11510
https://access.redhat.com/errata/RHSA-2026:19073
https://access.redhat.com/errata/RHSA-2026:19224
https://access.redhat.com/errata/RHSA-2026:21275
https://access.redhat.com/errata/RHSA-2026:22634
https://access.redhat.com/errata/RHSA-2026:28049
https://access.redhat.com/errata/RHSA-2026:28050
https://access.redhat.com/errata/RHSA-2026:28133
https://access.redhat.com/errata/RHSA-2026:30078
https://access.redhat.com/errata/RHSA-2026:30087
https://access.redhat.com/errata/RHSA-2026:30088
https://access.redhat.com/errata/RHSA-2026:30089
https://access.redhat.com/errata/RHSA-2026:30900
https://access.redhat.com/errata/RHSA-2026:33453
https://access.redhat.com/errata/RHSA-2026:34476
https://access.redhat.com/errata/RHSA-2026:34477
https://access.redhat.com/errata/RHSA-2026:36004
https://access.redhat.com/errata/RHSA-2026:36005
https://access.redhat.com/errata/RHSA-2026:36006
https://access.redhat.com/security/cve/CVE-2026-34982
https://bugzilla.redhat.com/show_bug.cgi?id=2455400
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34982.json