CVE-2026-34982

EUVD-2026-19313
Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.2 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 10%
Affected Products (NVD)
VendorProductVersion
vimvim
𝑥
< 9.2.0276
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
vim
bookworm
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
2:9.2.0461-1
fixed
sid
2:9.2.0461-1
fixed
trixie
vulnerable
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
gvim
suse enterprise sap 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise server 12 SP3
9.2.0280-17.62.1
fixed
suse enterprise server 12 SP5
9.2.0280-17.62.1
fixed
suse enterprise server 15 SP4
9.2.0280-150000.5.89.1
fixed
suse enterprise server 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP6
9.2.0280-150500.20.46.1
fixed
vim
suse enterprise desktop 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise server 12 SP3
9.2.0280-17.62.1
fixed
suse enterprise server 12 SP5
9.2.0280-17.62.1
fixed
suse enterprise server 15 SP4
9.2.0280-150000.5.89.1
fixed
suse enterprise server 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP7
9.2.0280-150500.20.46.1
fixed
vim-data
suse enterprise desktop 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise server 12 SP3
9.2.0280-17.62.1
fixed
suse enterprise server 12 SP5
9.2.0280-17.62.1
fixed
suse enterprise server 15 SP4
9.2.0280-150000.5.89.1
fixed
suse enterprise server 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP7
9.2.0280-150500.20.46.1
fixed
vim-data-common
suse enterprise desktop 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise server 12 SP3
9.2.0280-17.62.1
fixed
suse enterprise server 12 SP5
9.2.0280-17.62.1
fixed
suse enterprise server 15 SP4
9.2.0280-150000.5.89.1
fixed
suse enterprise server 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP7
9.2.0280-150500.20.46.1
fixed
vim-small
suse enterprise desktop 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise sap 15 SP7
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP4
9.2.0280-150000.5.89.1
fixed
suse enterprise server 15 SP5
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP6
9.2.0280-150500.20.46.1
fixed
suse enterprise server 15 SP7
9.2.0280-150500.20.46.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
vim-X11
RHEL 8
2:8.0.1763-22.el8_10.3
fixed
RHEL 9
2:8.2.2637-26.el9_8.4
fixed
vim-common
RHEL 8
2:8.0.1763-22.el8_10.3
fixed
RHEL 9
2:8.2.2637-23.el9_7.3
fixed
vim-enhanced
RHEL 8
2:8.0.1763-22.el8_10.3
fixed
RHEL 9
2:8.2.2637-26.el9_8.4
fixed
vim-filesystem
RHEL 8
2:8.0.1763-22.el8_10.3
fixed
RHEL 9
2:8.2.2637-23.el9_7.3
fixed
vim-minimal
RHEL 8
2:8.0.1763-22.el8_10.3
fixed
RHEL 9
2:8.2.2637-26.el9_8.4
fixed