CVE-2026-26269

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26269", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-12T17:10:53.413Z", "datePublished": "2026-02-13T19:18:41.662Z", "dateUpdated": "2026-02-13T21:11:26.275Z"}, "containers": {"cna": {"title": "Vim has a Netbeans specialKeys Stack Buffer Overflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "lang": "en", "description": "CWE-121: Stack-based Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/vim/vim/security/advisories/GHSA-9w5c-hwr9-hc68", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vim/vim/security/advisories/GHSA-9w5c-hwr9-hc68"}, {"name": "https://github.com/vim/vim/commit/c5f312aad8e4179e437f81ad39a860cd0ef11970", "tags": ["x_refsource_MISC"], "url": "https://github.com/vim/vim/commit/c5f312aad8e4179e437f81ad39a860cd0ef11970"}, {"name": "https://github.com/vim/vim/releases/tag/v9.1.2148", "tags": ["x_refsource_MISC"], "url": "https://github.com/vim/vim/releases/tag/v9.1.2148"}], "affected": [{"vendor": "vim", "product": "vim", "versions": [{"version": "< 9.1.2148", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-13T19:18:41.662Z"}, "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148."}], "source": {"advisory": "GHSA-9w5c-hwr9-hc68", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-13T19:49:31.578805Z", "id": "CVE-2026-26269", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T19:50:02.466Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/13/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-13T21:11:26.275Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/13/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-13T21:11:26.275Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26269", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-13T19:49:31.578805Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T19:49:54.780Z"}}], "cna": {"title": "Vim has a Netbeans specialKeys Stack Buffer Overflow", "source": {"advisory": "GHSA-9w5c-hwr9-hc68", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "vim", "product": "vim", "versions": [{"status": "affected", "version": "< 9.1.2148"}]}], "references": [{"url": "https://github.com/vim/vim/security/advisories/GHSA-9w5c-hwr9-hc68", "name": "https://github.com/vim/vim/security/advisories/GHSA-9w5c-hwr9-hc68", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/vim/vim/commit/c5f312aad8e4179e437f81ad39a860cd0ef11970", "name": "https://github.com/vim/vim/commit/c5f312aad8e4179e437f81ad39a860cd0ef11970", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/vim/vim/releases/tag/v9.1.2148", "name": "https://github.com/vim/vim/releases/tag/v9.1.2148", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-13T19:18:41.662Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26269", "state": "PUBLISHED", "dateUpdated": "2026-02-13T21:11:26.275Z", "dateReserved": "2026-02-12T17:10:53.413Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-13T19:18:41.662Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "vim", "vendor": "vim", "versions": [{"status": "affected", "version": "< 9.1.2148"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*", "matchCriteriaId": "19A1D55B-E01D-4324-B9FA-7FD3C9E65EE6", "versionEndExcluding": "9.1.2148", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148."}, {"lang": "es", "value": "Vim es un editor de texto de c\u00f3digo abierto, de l\u00ednea de comandos. Antes de la versi\u00f3n 9.1.2148, existe una vulnerabilidad de desbordamiento de b\u00fafer de pila en la integraci\u00f3n de NetBeans de Vim al procesar el comando specialKeys, afectando a las compilaciones de Vim que habilitan y usan la caracter\u00edstica de NetBeans. El desbordamiento de b\u00fafer de pila existe en special_keys() (en src/netbeans.c). El bucle while (*tok) escribe dos bytes por iteraci\u00f3n en un b\u00fafer de pila de 64 bytes (keybuf) sin verificaci\u00f3n de l\u00edmites. Un servidor NetBeans malicioso puede desbordar keybuf con un solo comando specialKeys. El problema ha sido solucionado a partir del parche de Vim v9.1.2148."}], "id": "CVE-2026-26269", "lastModified": "2026-06-17T10:26:01.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26269", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-13T19:49:31.578805Z", "version": "2.0.3"}}]}, "published": "2026-02-13T20:17:41.377", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/vim/vim/commit/c5f312aad8e4179e437f81ad39a860cd0ef11970"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/vim/vim/releases/tag/v9.1.2148"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/vim/vim/security/advisories/GHSA-9w5c-hwr9-hc68"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/02/13/2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vim: Netbeans specialKeys stack buffer overflow", "id": "2439755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439755"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-121", "details": ["A flaw was found in Vim. A stack-based buffer overflow in the NetBeans integration can be triggered in the special_keys function in the src/netbeans.c file via a malicious NetBeans server due to improper bounds checking, most likely resulting in a denial of service or in arbitrary command execution."], "name": "CVE-2026-26269", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-02-13T19:18:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-26269\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-26269\nhttps://github.com/vim/vim/commit/c5f312aad8e4179e437f81ad39a860cd0ef11970\nhttps://github.com/vim/vim/releases/tag/v9.1.2148\nhttps://github.com/vim/vim/security/advisories/GHSA-9w5c-hwr9-hc68"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.1.2148)"}}], "product": "vim", "vendor": "vim"}], "analysis": {"en": {"generated_at": "2026-04-17T19:48:34.321700+00:00", "value": {"mitigation_remediation": ["Update Vim to version v9.1.2148 or newer, which contains the protective fix.", "If the NetBeans integration is not required in your environment, disable the feature in Vim\u2019s configuration to eliminate the vulnerable code path.", "Limit the network connectivity between Vim and any NetBeans servers to trusted sources, ensuring that only authorized servers can issue specialKeys commands."], "summary": {"action": "Apply Patch", "impact": "Stack Buffer Overflow"}, "threat_synthesis": {"affected_systems": "The affected product is the Vim text editor, which is open\u2011source and command\u2011line based. All Vim installations that enable the NetBeans feature and run a version older than v9.1.2148 are vulnerable. The fix is upstreamed in Vim release v9.1.2148 and later.", "description_and_impact": "The vulnerability is a stack buffer overflow in Vim\u2019s NetBeans integration. When processing the specialKeys command, the special_keys() routine writes two bytes per iteration into a 64\u2011byte buffer on the stack without performing bounds checking. A malicious NetBeans server can send a single, crafted specialKeys command that overflows this buffer, potentially corrupting the stack and enabling arbitrary code execution or a crash. The issue affects Vim builds that enable the NetBeans feature and was fixed by patch v9.1.2148.", "risk_and_exploitability": "The CVSS score of 5.4 reflects moderate severity. The EPSS score of less than 1\u202f% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a malicious NetBeans server that can send the specialKeys payload. If an attacker controls such a server or influences the connection between Vim and a NetBeans server, they can trigger the overflow. Because the vulnerability requires a particular feature to be enabled and relies on a server interaction, the practical risk is moderate but the likelihood of exploitation is low."}}}}, "created": "2026-02-13T21:28:25.640756+00:00", "updated": "2026-04-17T20:00:09.004701+00:00", "vendors": ["vim", "vim$PRODUCT$vim"]}