CVE-2026-28420

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28420", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-27T15:33:57.290Z", "datePublished": "2026-02-27T22:04:36.189Z", "dateUpdated": "2026-03-02T21:55:05.724Z"}, "containers": {"cna": {"title": "Vim has Heap-based Buffer Overflow and OOB Read in :terminal", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg"}, {"name": "https://github.com/vim/vim/commit/bb6de2105b160e729c34063", "tags": ["x_refsource_MISC"], "url": "https://github.com/vim/vim/commit/bb6de2105b160e729c34063"}, {"name": "https://github.com/vim/vim/releases/tag/v9.2.0076", "tags": ["x_refsource_MISC"], "url": "https://github.com/vim/vim/releases/tag/v9.2.0076"}], "affected": [{"vendor": "vim", "product": "vim", "versions": [{"version": "< 9.2.0076", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T22:04:36.189Z"}, "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue."}], "source": {"advisory": "GHSA-rvj2-jrf9-2phg", "discovery": "UNKNOWN"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/27/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-28T00:15:35.201Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T21:54:55.613292Z", "id": "CVE-2026-28420", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T21:55:05.724Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/27/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-28T00:15:35.201Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28420", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T21:54:55.613292Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T21:55:00.912Z"}}], "cna": {"title": "Vim has Heap-based Buffer Overflow and OOB Read in :terminal", "source": {"advisory": "GHSA-rvj2-jrf9-2phg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "vim", "product": "vim", "versions": [{"status": "affected", "version": "< 9.2.0076"}]}], "references": [{"url": "https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg", "name": "https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/vim/vim/commit/bb6de2105b160e729c34063", "name": "https://github.com/vim/vim/commit/bb6de2105b160e729c34063", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/vim/vim/releases/tag/v9.2.0076", "name": "https://github.com/vim/vim/releases/tag/v9.2.0076", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T22:04:36.189Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28420", "state": "PUBLISHED", "dateUpdated": "2026-03-02T21:55:05.724Z", "dateReserved": "2026-02-27T15:33:57.290Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-27T22:04:36.189Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "vim", "vendor": "vim", "versions": [{"status": "affected", "version": "< 9.2.0076"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*", "matchCriteriaId": "84ED21C8-279B-4954-AEE5-9E56089D7EB6", "versionEndExcluding": "9.2.0076", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue."}, {"lang": "es", "value": "Vim es un editor de texto de c\u00f3digo abierto y de l\u00ednea de comandos. Antes de la versi\u00f3n 9.2.0076, hay una escritura de desbordamiento de b\u00fafer basado en mont\u00edculo y una lectura fuera de l\u00edmites en el emulador de terminal de Vim al procesar caracteres combinatorios m\u00e1ximos de planos suplementarios de Unicode. La versi\u00f3n 9.2.0076 corrige el problema."}], "id": "CVE-2026-28420", "lastModified": "2026-06-17T10:28:35.407", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28420", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T21:54:55.613292Z", "version": "2.0.3"}}]}, "published": "2026-02-27T22:16:25.330", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/vim/vim/commit/bb6de2105b160e729c34063"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/vim/vim/releases/tag/v9.2.0076"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/02/27/9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator", "id": "2443484", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443484"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-125", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-28420", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-02-27T22:04:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-28420\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-28420\nhttps://github.com/vim/vim/commit/bb6de2105b160e729c34063\nhttps://github.com/vim/vim/releases/tag/v9.2.0076\nhttps://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.2.0076)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vim", "source": "cna", "vendor": "vim"}, "product": "vim", "vendor": "vim"}], "analysis": {"en": {"generated_at": "2026-04-16T15:09:35.730089+00:00", "value": {"mitigation_remediation": ["Upgrade Vim to version 9.2.0076 or later to apply the fix for the terminal buffer overflow and out-of-bounds read.", "If an upgrade cannot be performed immediately, disable Vim's terminal emulator feature (e.g., remove or comment out the :terminal command) to eliminate the attack surface.", "Enforce strict input validation or restrict Unicode combining character usage in environments where Vim's terminal is needed, ensuring no malicious characters are processed."], "summary": {"action": "Patch", "impact": "Heap-based buffer overflow and out-of-bounds read in Vim's terminal emulator, risking memory corruption and potential code execution"}, "threat_synthesis": {"affected_systems": "Affected products are all releases of the Vim text editor before version 9.2.0076. The fixed version 9.2.0076 and any later releases contain a patch that removes the vulnerable parsing logic. Vim is distributed under the Vim license and is commonly installed on Unix-like systems and Windows.", "description_and_impact": "Vim's terminal emulator contains a heap-based buffer overflow WRITE and an out-of-bounds READ when it processes maximum combining characters from Unicode supplementary planes. These errors fall under CWE-122 and CWE-125. The overflow allows an attacker to corrupt memory, which could lead to crashes, data leakage, or, in the worst case, arbitrary code execution if the corrupted memory can be leveraged. The exact damage depends on the context in which Vim runs but memory corruption is inherently dangerous.", "risk_and_exploitability": "The CVSS base score of 4.4 indicates moderate impact. EPSS shows a probability of exploitation below 1\u202f%, meaning real-world exploitation is currently very unlikely, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The vulnerability is most likely exploitable from a local context where an attacker can supply crafted Unicode input to Vim's terminal session; remote exploitation would require additional components that are not indicated in the description. Given the low EPSS, the risk to exposed environments is modest but upgrading remains prudent."}}}}, "created": "2026-03-02T12:04:37.011030+00:00", "updated": "2026-04-16T15:15:39.045977+00:00", "vendors": ["vim", "vim$PRODUCT$vim"]}