CVE-2026-73076

EUVD-2026-56231

11.08.2026, 16:17

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.

Code Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
GitHub_M	CNA	8.4 HIGH	LOCAL	LOW	NONE	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 2.21%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
vim	vim	𝑥 < 9.2.847	CNA

Debian Releases

Debian Product

Codename

vim

bookworm	vulnerable
forky	2:9.2.0858-1 fixed
sid	2:9.2.0858-1 fixed
trixie	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

vim

bionic	Fixed 2:8.0.1453-1ubuntu1.13+esm23 released
focal	Fixed 2:8.1.2269-1ubuntu5.32+esm12 released
jammy	Fixed 2:8.2.3995-1ubuntu2.35 released
noble	Fixed 2:9.1.0016-1ubuntu7.19 released
resolute	Fixed 2:9.1.2141-1ubuntu4.8 released
trusty	Fixed 2:7.4.052-1ubuntu3.1+esm32 released
xenial	Fixed 2:7.4.1689-3ubuntu1.5+esm38 released

openSUSE / SLES Releases

openSUSE Product

Release

gvim

suse enterprise sap 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise sap 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise sap 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise server 12 SP3	9.2.0957-17.76.1 fixed
suse enterprise server 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise server 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise server 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP6	9.2.0957-150500.20.64.1 fixed

vim

suse enterprise desktop 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise sap 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise sap 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise server 12 SP3	9.2.0957-17.76.1 fixed
suse enterprise server 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise server 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise server 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP7	9.2.0957-150500.20.64.1 fixed

vim-data

suse enterprise desktop 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise sap 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise sap 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise server 12 SP3	9.2.0957-17.76.1 fixed
suse enterprise server 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise server 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise server 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP7	9.2.0957-150500.20.64.1 fixed

vim-data-common

suse enterprise desktop 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise sap 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise sap 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise server 12 SP3	9.2.0957-17.76.1 fixed
suse enterprise server 12 SP5	9.2.0957-17.76.1 fixed
suse enterprise server 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise server 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP7	9.2.0957-150500.20.64.1 fixed

vim-small

suse enterprise desktop 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise sap 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise sap 15 SP7	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP4	9.2.0957-150000.5.102.1 fixed
suse enterprise server 15 SP5	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP6	9.2.0957-150500.20.64.1 fixed
suse enterprise server 15 SP7	9.2.0957-150500.20.64.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

vim-X11

RHEL 8	2:8.0.1763-31.el8_10.7 fixed
RHEL 9	2:8.2.2637-26.el9_8.21 fixed

vim-common

RHEL 8	2:8.0.1763-31.el8_10.7 fixed
RHEL 9	2:8.2.2637-26.el9_8.21 fixed

vim-enhanced

RHEL 8	2:8.0.1763-31.el8_10.7 fixed
RHEL 9	2:8.2.2637-26.el9_8.21 fixed

Amazon Linux Releases

Amazon Package

Release

vim-X11

Amazon Linux 2

2:9.0.2153-1.amzn2.0.10

fixed

vim-common

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-data

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-debuginfo

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-debugsource

Amazon Linux 2023

2:9.2.920-1.amzn2023.0.1

fixed

vim-default-editor

Amazon Linux 2023

2:9.2.920-1.amzn2023.0.1

fixed

vim-enhanced

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-enhanced-debuginfo

Amazon Linux 2023

2:9.2.920-1.amzn2023.0.1

fixed

vim-filesystem

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-minimal

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

vim-minimal-debuginfo

Amazon Linux 2023

2:9.2.920-1.amzn2023.0.1

fixed

xxd

Amazon Linux 2	2:9.0.2153-1.amzn2.0.10 fixed
Amazon Linux 2023	2:9.2.920-1.amzn2023.0.1 fixed

xxd-debuginfo

Amazon Linux 2023

2:9.2.920-1.amzn2023.0.1

fixed

Azure Linux Releases

Azure Package

Release

vim

Azure Linux 3.0

0:9.2.0957-1.azl3

fixed

Common Weakness Enumeration

CWE-94 - Improper Control of Generation of Code ('Code Injection')
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References

https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452

https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2