VIM vulnerabilities
231 CVEs and advisories name VIM as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-43961Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
- CVE-2026-73073Vim: Arbitrary Ex Command Execution in C Omni-Completion
- CVE-2026-73078Vim: Arbitrary Code Execution via Netrw Menu Construction
- CVE-2026-73077Vim: Arbitrary Code Execution via Shell Keyword Lookup
- CVE-2026-73076Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`
- CVE-2026-73075Vim: Out-of-bounds Access in Popup Opacity Handling
- CVE-2026-73074Vim: Heap Buffer Overflow in Text Property Handling
- CVE-2026-73072Vim: Heap Buffer Overflow when Loading a Spell File
- CVE-2026-73071Vim: Use-after-free in JSON Decoding
- CVE-2026-73070Vim: Stack Buffer Overflow in the Vim Socket Server
- CVE-2026-59856Vim: Arbitrary Code Execution via PHP Omni-Completion
- CVE-2026-59858Vim: Arbitrary Code Execution via C Omni-Completion
- CVE-2026-59857Vim: Out-of-bounds Write in SAL Soundfolding
- CVE-2026-55693Vim: Out-of-bounds Write in Spell File Word Count
- CVE-2026-55892Vim: Out-of-bounds Write in Spell File Prefix Dump
- CVE-2026-55895Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename
- CVE-2026-57451Vim: Out-of-bounds Read in Text Property Count
- CVE-2026-57452Vim: Out-of-bounds Read with libsodium-encrypted Files
- CVE-2026-57453Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction
- CVE-2026-57454Vim: Out-of-bounds Read with Text Properties
- CVE-2026-57455Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument
- CVE-2026-57456Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings
- CVE-2026-52860Vim: Arbitrary Code Execution via Python Omni-Completion
- CVE-2026-52859Vim: Out-of-bounds Read in Terminal Screen Snapshot
- CVE-2026-52858Vim: Arbitrary Code Execution via Python Omni-Completion
- CVE-2026-47162Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name
- CVE-2026-47167Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex
- CVE-2026-46483Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag
- CVE-2026-45130Vim: Heap Buffer Overflow in spell file loading
- CVE-2026-44656Vim: OS Command Injection via 'path' completion