Multiple security vulnerabilities have been identified in Vim, an enhanced version of the standard UNIX editor. These flaws affect various components including plugins, file handling routines, and interface protocols, allowing remote attackers to trigger arbitrary code execution, command injection, or application crashes via crafted files or inputs. The overall risk is high, as exploitation can lead to full system compromise or denial of service.
CVE-2025-53905: The tar plugin failed to protect archive member names against path traversal sequences, allowing files to be extracted outside the intended directory.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Vim, an enhanced version of the standard UNIX editor. These flaws affect various components including plugins, file handling routines, and interface protocols, allowing remote attackers to trigger arbitrary code execution, command injection, or application crashes via crafted files or inputs. The overall risk is high, as exploitation can lead to full system compromise or denial of service.
CVE-2025-53905: The tar plugin failed to protect archive member names against path traversal sequences, allowing files to be extracted outside the intended directory.[emaillocker id="1283"]
CVE-2025-53906: The zip plugin contained a similar path traversal flaw, permitting archive members to escape the target directory through crafted names.
CVE-2026-25749: A buffer overflow existed in the handling of the helpfile option, where overlong help file paths could overflow a fixed-size buffer.
CVE-2026-26269: The NetBeans interface was vulnerable to a buffer overflow triggered by specially crafted protocol input.
CVE-2026-28417: Command injection was possible in the netrw component when crafted file names broke out of expected command structures.
CVE-2026-28418: An overlong emacs tag file line could cause a crash in the tag reader component.
CVE-2026-28419: Crafted emacs tag files could cause a buffer underflow, leading to potential memory corruption.
CVE-2026-28420: A buffer overflow in terminal handling could be triggered by combining characters, potentially corrupting memory.
CVE-2026-28421: Malformed swap files could crash the application during the recovery process.
CVE-2026-28422: A stack buffer overflow in the statusline string generation function could be triggered by multibyte fill characters.
CVE-2026-32249: A composing character ending a character range in a regular expression could corrupt the NFA regex compiler, causing a crash.
CVE-2026-33412: A newline character within a glob pattern could be used to inject shell commands.
CVE-2026-34982: Modeline processing could be abused to bypass existing security restrictions.
CVE-2026-35177: The zip plugin was vulnerable to path traversal, allowing archive entries with specific sequences to escape the target directory.
CVE-2026-39881: Command injection was possible in the NetBeans interface through specific annotation types or special keys.
CVE-2026-41411: Backticks present in tag files could trigger shell execution, leading to command injection.
CVE-2026-42307: Malicious URLs using specific protocols in netrw could inject shell commands.
CVE-2026-43961: The mf command in netrw could be exploited to run injected Vim script.
CVE-2026-44656: Backtick expressions in the path option could cause shell execution during completion.
CVE-2026-45130: A heap buffer overflow in the spell file reading function could be triggered by a crafted spell file.
CVE-2026-46483: The tar plugin was vulnerable to command injection through crafted archive filenames.
CVE-2026-47162: Bookmark or history data in netrw could be used to inject Vim commands.
CVE-2026-47167: The cucumber filetype plugin allowed crafted feature files to run Vim commands.
CVE-2026-52858: The python3complete feature could execute unsafe Python imports, leading to code execution.
CVE-2026-52859: An out-of-bounds read in the terminal snapshot update function could be triggered by specific terminal states.
CVE-2026-52860: The python complete feature could execute unsafe Python code, allowing for code execution.
CVE-2026-55693: A crafted spell file could cause an out-of-bounds write in the word counting function.
CVE-2026-55892: A stack out-of-bounds write in the prefix dumping function could be triggered by a crafted spell file.
CVE-2026-55895: Local file deletion in netrw could be exploited to run injected commands.
CVE-2026-57452: Malformed sodium-encrypted files could cause an out-of-bounds read.
CVE-2026-57455: Crafted spell data could cause an out-of-bounds write when using the soundfold function.
CVE-2026-57456: The python complete feature could execute unsafe Python code, allowing for code execution.
CVE-2026-59856: A crafted PHP buffer could execute commands during omni-completion.
CVE-2026-59857: Crafted spell data could cause a stack out-of-bounds write in the soundfold function.
CVE-2026-59858: Completion of C code could run injected Ex commands, allowing for arbitrary command execution.
CVE-2026-73072: A heap buffer overflow in the soundfold table setting function could be triggered by crafted spell files.
CVE-2026-73073: Completion of C code could run injected Ex commands, allowing for arbitrary command execution.
CVE-2026-73076: A crafted vimball record file could execute arbitrary commands upon removal.
CVE-2026-73077: The keyword command was not protected against injection, allowing for arbitrary code execution.
CVE-2026-73078: Bookmark or menu data in netrw could be used to inject Ex commands.
These vulnerabilities collectively present a significant risk to users who open untrusted files or interact with malicious content in the editor. The most at-risk individuals are those processing archives, help files, or code from unknown sources. Users should ensure their software is updated to the latest secure version to mitigate these threats.
We recommend you to update vim to version 2:9.1.1230-2+deb13u1.
The following reports contain further technical details:
[/emaillocker]