CVE-2026-28421
published 2026-02-27CVE-2026-28421: Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap…
PriorityP340high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.18%
7.4th percentile
Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | vim | < vim 2:9.2.0119-1 (forky) | vim 2:9.2.0119-1 (forky) |
| msrc | azl3_vim_9.1.1616-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_vim_9.1.1616-1_on_cbl_mariner_2.0 | — | — |
| vim | vim | < 9.2.0077 | 9.2.0077 |
| vim | vim | >= 0 < 2:9.2.0119-1 | 2:9.2.0119-1 |
| vim | vim | >= 0 < 2:8.2.3995-1ubuntu2.26 | 2:8.2.3995-1ubuntu2.26 |
| vim | vim | >= 0 < 2:9.1.0016-1ubuntu7.10 | 2:9.1.0016-1ubuntu7.10 |
| vim | vim | >= 0 < 2:9.1.0967-1ubuntu6.1 | 2:9.1.0967-1ubuntu6.1 |
| vim | vim | >= 0 < 2:7.4.052-1ubuntu3.1+esm23 | 2:7.4.052-1ubuntu3.1+esm23 |
| vim | vim | >= 0 < 2:7.4.1689-3ubuntu1.5+esm29 | 2:7.4.1689-3ubuntu1.5+esm29 |
| vim | vim | >= 0 < 2:8.0.1453-1ubuntu1.13+esm14 | 2:8.0.1453-1ubuntu1.13+esm14 |
| vim | vim | >= 0 < 2:8.1.2269-1ubuntu5.32+esm2 | 2:8.1.2269-1ubuntu5.32+esm2 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_ubuntu6.6MEDIUM
vendor_debian5.3MEDIUM
vendor_msrc5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Vim vulnerabilities
vendor_ubuntu·2026-03-16·CVSS 6.6
CVE-2026-25749 [MEDIUM] Vim vulnerabilities
Title: Vim vulnerabilities
Summary: Several security issues were fixed in Vim.
Rahul Hoysala discovered that Vim did not correctly handle certain tag
resolutions. An attacker could possibly use this issue to cause a denial
of service. (CVE-2026-25749)
It was discovered that Vim did not correctly handle processing certain
specialKey commands. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-26269)
Kim Dong Han discovered that Vim did not correctly handle opening certain
URLs. If a user or system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-28417)
Kim Dong Han discovered that Vim did not correctly handle parsing
Emacs-style tag files. An attack
Red Hat
vim: Vim: Denial of service and information disclosure via crafted swap file
vendor_redhat·2026-02-27·CVSS 5.3
CVE-2026-28421 [MEDIUM] CWE-120 vim: Vim: Denial of service and information disclosure via crafted swap file
vim: Vim: Denial of service and information disclosure via crafted swap file
Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.
A flaw was found in Vim. This vulnerability, a heap-buffer-overflow and a segmentation fault, exists in the swap file recovery logic. A local attacker could exploit this by providing a specially crafted swap file. This could lead to a denial of service (DoS) or potentially information disclosure.
Statement: The risk posed by this vulnerability is limited on Red Hat products due to user and system isolation features
Microsoft
Vim has a heap-buffer-overflow and a segmentation fault
vendor_msrc·2026-02-10·CVSS 5.3
CVE-2026-28421 [MEDIUM] CWE-20 Vim has a heap-buffer-overflow and a segmentation fault
Vim has a heap-buffer-overflow and a segmentation fault
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2026-28421: vim - Vim is an open source, command line text editor. Versions prior to 9.2.0077 have...
vendor_debian·2026·CVSS 5.3
CVE-2026-28421 [MEDIUM] CVE-2026-28421: vim - Vim is an open source, command line text editor. Versions prior to 9.2.0077 have...
Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2:9.2.0119-1)
sid: resolved (fixed in 2:9.2.0119-1)
trixie: open
VulDB
vim up to 9.2.0076 unvalidated memory corruption (GHSA-r2gw-2x48-jj5p / EUVD-2026-9089)
vuldb·2026-04-16·CVSS 7.8
CVE-2026-28421 [HIGH] vim up to 9.2.0076 unvalidated memory corruption (GHSA-r2gw-2x48-jj5p / EUVD-2026-9089)
A vulnerability classified as critical was found in vim up to 9.2.0076. Affected by this issue is some unknown functionality. Executing a manipulation of the argument unvalidated can lead to memory corruption.
This vulnerability is registered as CVE-2026-28421. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is advised.
OSV
vim vulnerabilities
osv·2026-03-16·CVSS 6.6
CVE-2026-25749 [MEDIUM] vim vulnerabilities
vim vulnerabilities
Rahul Hoysala discovered that Vim did not correctly handle certain tag
resolutions. An attacker could possibly use this issue to cause a denial
of service. (CVE-2026-25749)
It was discovered that Vim did not correctly handle processing certain
specialKey commands. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2026-26269)
Kim Dong Han discovered that Vim did not correctly handle opening certain
URLs. If a user or system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-28417)
Kim Dong Han discovered that Vim did not correctly handle parsing
Emacs-style tag files. An attacker could possibly use this issue to cause
a denial of servic
OSV
CVE-2026-28421: Vim is an open source, command line text editor
osv·2026-02-27·CVSS 7.8
CVE-2026-28421 [HIGH] CVE-2026-28421: Vim is an open source, command line text editor
Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-28421 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-28421 [MEDIUM] CVE-2026-28421 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28421 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.
Source : NVD
## 7.8
Score
Published February 27, 2026
Severity HIGH
CNA Score 5.3
Affected Technologies
Vim
Alma Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
vim-default-editor
xxd
Sources
Alpine 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17
Bugzilla
CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file
bugzilla·2026-02-27·CVSS 5.3
CVE-2026-28421 [MEDIUM] CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file
CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file
Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10.0 Extended Update Support
Via RHSA-2026:6502 https://access.redhat.com/errata/RHSA-2026:6502
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9.4 Extended Update Support
Via RHSA-2026:6540 https://access.redhat.com/errata/RHSA-2026:6540
---
This issue has been
2026-02-27
Published