CVE-2026-28419
published 2026-02-27CVE-2026-28419: Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic…
PriorityP427medium6.6CVSS 3.1
AVLACLPRNUIRSUCLILAH
EPSS
0.17%
6.4th percentile
Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | vim | < vim 2:9.2.0119-1 (forky) | vim 2:9.2.0119-1 (forky) |
| msrc | azl3_vim_9.1.1616-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_vim_9.1.1616-1_on_cbl_mariner_2.0 | — | — |
| vim | vim | < 9.2.0075 | 9.2.0075 |
| vim | vim | >= 0 < 2:9.2.0119-1 | 2:9.2.0119-1 |
| vim | vim | >= 0 < 2:8.2.3995-1ubuntu2.26 | 2:8.2.3995-1ubuntu2.26 |
| vim | vim | >= 0 < 2:9.1.0016-1ubuntu7.10 | 2:9.1.0016-1ubuntu7.10 |
| vim | vim | >= 0 < 2:9.1.0967-1ubuntu6.1 | 2:9.1.0967-1ubuntu6.1 |
| vim | vim | >= 0 < 2:7.4.052-1ubuntu3.1+esm23 | 2:7.4.052-1ubuntu3.1+esm23 |
| vim | vim | >= 0 < 2:7.4.1689-3ubuntu1.5+esm29 | 2:7.4.1689-3ubuntu1.5+esm29 |
| vim | vim | >= 0 < 2:8.0.1453-1ubuntu1.13+esm14 | 2:8.0.1453-1ubuntu1.13+esm14 |
| vim | vim | >= 0 < 2:8.1.2269-1ubuntu5.32+esm2 | 2:8.1.2269-1ubuntu5.32+esm2 |
CVSS provenance
nvdv3.16.6MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
osv6.6MEDIUM
vendor_ubuntu6.6MEDIUM
vendor_debian5.3MEDIUM
vendor_msrc5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Vim vulnerabilities
vendor_ubuntu·2026-03-16·CVSS 6.6
CVE-2026-25749 [MEDIUM] Vim vulnerabilities
Title: Vim vulnerabilities
Summary: Several security issues were fixed in Vim.
Rahul Hoysala discovered that Vim did not correctly handle certain tag
resolutions. An attacker could possibly use this issue to cause a denial
of service. (CVE-2026-25749)
It was discovered that Vim did not correctly handle processing certain
specialKey commands. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-26269)
Kim Dong Han discovered that Vim did not correctly handle opening certain
URLs. If a user or system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-28417)
Kim Dong Han discovered that Vim did not correctly handle parsing
Emacs-style tag files. An attack
Red Hat
vim: Vim: Information disclosure and denial of service via malformed tags file
vendor_redhat·2026-02-27·CVSS 5.3
CVE-2026-28419 [MEDIUM] CWE-124 vim: Vim: Information disclosure and denial of service via malformed tags file
vim: Vim: Information disclosure and denial of service via malformed tags file
Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.
A flaw was found in Vim, an open-source command-line text editor. This vulnerability, a heap-based buffer underflow, occurs when Vim processes a specially crafted Emacs-style tags file. If a malicious file with a delimiter at the start of a line is opened, Vim attempts to read memory outside its designated area. This could lead to the disclosure of sensitive infor
Microsoft
Vim has Heap-based Buffer Underflow in Emacs tags parsing
vendor_msrc·2026-02-10·CVSS 5.3
CVE-2026-28419 [MEDIUM] CWE-124 Vim has Heap-based Buffer Underflow in Emacs tags parsing
Vim has Heap-based Buffer Underflow in Emacs tags parsing
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2026-28419: vim - Vim is an open source, command line text editor. Prior to version 9.2.0075, a he...
vendor_debian·2026·CVSS 5.3
CVE-2026-28419 [MEDIUM] CVE-2026-28419: vim - Vim is an open source, command line text editor. Prior to version 9.2.0075, a he...
Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2:9.2.0119-1)
sid: resolved (fixed in 2:9.2.0119-1)
trixie: open
OSV
vim vulnerabilities
osv·2026-03-16·CVSS 6.6
CVE-2026-25749 [MEDIUM] vim vulnerabilities
vim vulnerabilities
Rahul Hoysala discovered that Vim did not correctly handle certain tag
resolutions. An attacker could possibly use this issue to cause a denial
of service. (CVE-2026-25749)
It was discovered that Vim did not correctly handle processing certain
specialKey commands. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-26269)
Kim Dong Han discovered that Vim did not correctly handle opening certain
URLs. If a user or system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-28417)
Kim Dong Han discovered that Vim did not correctly handle parsing
Emacs-style tag files. An attacker could possibly use this issue to cause
a denial of servic
OSV
CVE-2026-28419: Vim is an open source, command line text editor
osv·2026-02-27·CVSS 6.6
CVE-2026-28419 [MEDIUM] CVE-2026-28419: Vim is an open source, command line text editor
Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-28419 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-28419 [MEDIUM] CVE-2026-28419 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28419 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.
Source : NVD
## 6.6
Score
Published February 27, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Vim
Alma Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
vim-filesystem
vim-X11
Sources
Bugzilla
CVE-2026-28419 vim: Vim: Information disclosure and denial of service via malformed tags file
bugzilla·2026-02-27·CVSS 5.3
CVE-2026-28419 [MEDIUM] CVE-2026-28419 vim: Vim: Information disclosure and denial of service via malformed tags file
CVE-2026-28419 vim: Vim: Information disclosure and denial of service via malformed tags file
Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.
2026-02-27
Published