CVE-2026-52859
Vim vulnerabilities
Description
Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.
Metrics
Weakness classes (CWE)
CWE-125Base
Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
cwe.mitre.org →
Reanalysis & status changes
Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.
- Initial Analysis2026-06-15 13:12 UTC· nvd@nist.gov
- CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- CPE Configuration: OR *cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* versions up to (excluding) 9.2.0565
- Reference Type: GitHub, Inc.: https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19 Types: Patch
- Reference Type: GitHub, Inc.: https://github.com/vim/vim/releases/tag/v9.2.0565 Types: Release Notes
Affected operating systems
linux
ubuntu / vimbionic
linux
ubuntu / vimfocal
linux
ubuntu / vimjammy
linux
ubuntu / vimnoble
linux
ubuntu / vimquesting
linux
ubuntu / vimresolute
linux
ubuntu / vimtrusty
linux
ubuntu / vimxenial
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
vim
vim9.2.0495
vim
vim9.2.0597
References & sources
- https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9x_refsource_CONFIRM
- https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934x_refsource_MISC
- https://github.com/vim/vim/releases/tag/v9.2.0496x_refsource_MISC
- https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7cx_refsource_CONFIRM
- https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8dx_refsource_MISC
- https://github.com/vim/vim/releases/tag/v9.2.0561x_refsource_MISC
- https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468x_refsource_CONFIRM
- https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2x_refsource_MISC
- https://github.com/vim/vim/releases/tag/v9.2.0597x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-52860vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2487987issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52860.jsonx_sadp-csaf-vex
- https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7cx_refsource_CONFIRM
- https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694bx_refsource_MISC
- https://github.com/vim/vim/releases/tag/v9.2.0495x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-47162vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2487964issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47162.jsonx_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:38509vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:38510vendor-advisoryx_refsource_REDHAT
Linked CVEs
- CVE-2026-52860
Vim is an open source, command line text editor.
highCVSSv3 8.0 - CVE-2026-52858
A flaw was found in Vim, a widely used command-line text editor.
high - CVE-2026-47167
A flaw was found in Vim, a command-line text editor.
medium - CVE-2026-47162
A flaw was found in Vim, an open-source text editor.
highCVSSv3 8.8