Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 262

Export CSV
CVE-2026-73074

Vim: Heap Buffer Overflow in Text Property Handling

Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2026-73075

Vim: Out-of-bounds Access in Popup Opacity Handling

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2026-73076

Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2026-73077

Vim: Arbitrary Code Execution via Shell Keyword Lookup

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2026-73078

Vim: Arbitrary Code Execution via Netrw Menu Construction

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2022-4141

Heap-based Buffer Overflow in vim/vim

Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Neovim and 1 more
Products
Debian Linux Fedora Neovim and 1 more
CVE-2022-3591

Use After Free in vim/vim

Use After Free in GitHub repository vim/vim prior to 9.0.0789.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Neovim Vim
Products
Neovim Vim
CVE-2023-4734

Integer Overflow or Wraparound in vim/vim

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Neovim Vim
Products
Macos Neovim Vim