CVE-2026-28418

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28418", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-27T15:33:57.290Z", "datePublished": "2026-02-27T21:58:37.277Z", "dateUpdated": "2026-03-02T21:52:42.959Z"}, "containers": {"cna": {"title": "Vim has Heap-based Buffer Overflow in Emacs tags parsing", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/vim/vim/security/advisories/GHSA-h4mf-vg97-hj8j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vim/vim/security/advisories/GHSA-h4mf-vg97-hj8j"}, {"name": "https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb", "tags": ["x_refsource_MISC"], "url": "https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb"}, {"name": "https://github.com/vim/vim/releases/tag/v9.2.0074", "tags": ["x_refsource_MISC"], "url": "https://github.com/vim/vim/releases/tag/v9.2.0074"}], "affected": [{"vendor": "vim", "product": "vim", "versions": [{"version": "< 9.2.0074", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T21:58:37.277Z"}, "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue."}], "source": {"advisory": "GHSA-h4mf-vg97-hj8j", "discovery": "UNKNOWN"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/27/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-28T00:15:32.223Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T21:52:34.360613Z", "id": "CVE-2026-28418", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T21:52:42.959Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/27/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-28T00:15:32.223Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28418", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T21:52:34.360613Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T21:52:39.685Z"}}], "cna": {"title": "Vim has Heap-based Buffer Overflow in Emacs tags parsing", "source": {"advisory": "GHSA-h4mf-vg97-hj8j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "vim", "product": "vim", "versions": [{"status": "affected", "version": "< 9.2.0074"}]}], "references": [{"url": "https://github.com/vim/vim/security/advisories/GHSA-h4mf-vg97-hj8j", "name": "https://github.com/vim/vim/security/advisories/GHSA-h4mf-vg97-hj8j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb", "name": "https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/vim/vim/releases/tag/v9.2.0074", "name": "https://github.com/vim/vim/releases/tag/v9.2.0074", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T21:58:37.277Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28418", "state": "PUBLISHED", "dateUpdated": "2026-03-02T21:52:42.959Z", "dateReserved": "2026-02-27T15:33:57.290Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-27T21:58:37.277Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "vim", "vendor": "vim", "versions": [{"status": "affected", "version": "< 9.2.0074"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*", "matchCriteriaId": "969B50CB-4E2C-4F12-839D-39D4116BDBBC", "versionEndExcluding": "9.2.0074", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue."}, {"lang": "es", "value": "Vim es un editor de texto de c\u00f3digo abierto y de l\u00ednea de comandos. Antes de la versi\u00f3n 9.2.0074, hay un desbordamiento de b\u00fafer basado en mont\u00edculo con lectura fuera de l\u00edmites en la l\u00f3gica de an\u00e1lisis de archivos de etiquetas estilo Emacs de Vim. Al procesar un archivo de etiquetas malformado, Vim puede ser enga\u00f1ado para leer hasta 7 bytes m\u00e1s all\u00e1 del l\u00edmite de memoria asignada. La versi\u00f3n 9.2.0074 corrige el problema."}], "id": "CVE-2026-28418", "lastModified": "2026-06-17T10:28:35.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28418", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T21:52:34.360613Z", "version": "2.0.3"}}]}, "published": "2026-02-27T22:16:25.003", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/vim/vim/releases/tag/v9.2.0074"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/vim/vim/security/advisories/GHSA-h4mf-vg97-hj8j"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/02/27/7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vim: Vim: Information disclosure via heap-based buffer overflow in Emacs-style tags file parsing", "id": "2443481", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443481"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-125", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-28418", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-02-27T21:58:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-28418\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-28418\nhttps://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb\nhttps://github.com/vim/vim/releases/tag/v9.2.0074\nhttps://github.com/vim/vim/security/advisories/GHSA-h4mf-vg97-hj8j"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.2.0074)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vim", "source": "cna", "vendor": "vim"}, "product": "vim", "vendor": "vim"}], "analysis": {"en": {"generated_at": "2026-04-18T10:13:24.710052+00:00", "value": {"mitigation_remediation": ["Apply the official Vim 9.2.0074 release, which patches the heap\u2011based buffer overflow (CWE\u2011122) and the out\u2011of\u2011bounds read (CWE\u2011125) in Emacs\u2011style tags parsing.", "When Vim must process tags files from untrusted sources, enforce strict input validation and size limits on the tags file before parsing to mitigate the CWE\u2011122 and CWE\u2011125 weaknesses; or disable automatic tags parsing for such sources.", "After the update, check Vim\u2019s configuration to prevent automatic loading of tags files from external or potentially attacker\u2011controlled locations, reducing the risk of these heap and read overflows."], "summary": {"action": "Update Vim", "impact": "Heap-based buffer overflow in Vim's Emacs tags parsing"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Vim text editor by the Vim project. All releases before Vim 9.2.0074 are impacted; versions 9.2.0074 and later include the fix.", "description_and_impact": "Vim versions prior to 9.2.0074 contain a heap\u2011based buffer overflow that occurs when parsing Emacs\u2011style tags files. A malformed tags file can cause Vim to read up to seven bytes beyond the allocated memory boundary. The description does not confirm code execution, but reads beyond the boundary could lead to information leakage or instability.", "risk_and_exploitability": "The CVSS score of 4.4 indicates a moderate severity, and the EPSS score of less than 1% reflects a low probability of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack vector is local; an attacker must supply a crafted tags file when running Vim. The buffer overflow is a read out\u2011of\u2011bounds, so the attack requires local access to execute the program with the malicious file. No remote exploitation path is documented, and the risk remains moderate given the low exploitation probability."}}}}, "created": "2026-03-02T12:04:38.740016+00:00", "updated": "2026-04-18T10:15:25.881454+00:00", "vendors": ["vim", "vim$PRODUCT$vim"]}