CVE-2026-34714
published 2026-03-30CVE-2026-34714: Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs…
PriorityP349high8.6CVSS 3.1
AVLACLPRNUIRSCCHIHAH
EPSS
0.59%
44.2th percentile
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | vim | < vim 2:9.2.0315-1 (sid) | vim 2:9.2.0315-1 (sid) |
| vim | vim | < 9.2.0272 | 9.2.0272 |
| vim | vim | >= 9.1.1390 < 9.2.0272 | 9.2.0272 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
osv8.6HIGH
vendor_debian9.2LOW
vendor_redhat9.2CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
vim: Vim: Arbitrary code execution via crafted file
vendor_redhat·2026-03-30·CVSS 9.2
CVE-2026-34714 [CRITICAL] CWE-917 vim: Vim: Arbitrary code execution via crafted file
vim: Vim: Arbitrary code execution via crafted file
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
A flaw was found in Vim. This vulnerability allows an attacker to execute malicious code on a user's system. This occurs when a user opens a specially crafted file, leading to immediate code execution due to a vulnerability in how Vim handles expressions within its tabpanel feature.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: vim (Red Hat Enter
Debian
CVE-2026-34714: vim - Vim before 9.2.0272 allows code execution that happens immediately upon opening ...
vendor_debian·2026·CVSS 9.2
CVE-2026-34714 [CRITICAL] CVE-2026-34714: vim - Vim before 9.2.0272 allows code execution that happens immediately upon opening ...
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
Scope: local
bookworm: resolved
bullseye: resolved
forky: open
sid: resolved (fixed in 2:9.2.0315-1)
trixie: resolved
OSV
CVE-2026-34714: (Vim before 9
osv·2026-03-31·CVSS 8.6
CVE-2026-34714 [HIGH] CVE-2026-34714: (Vim before 9
(Vim before 9.2.0272 allows code execution that happens immediately upo ...)
OSV
CVE-2026-34714: Vim before 9
osv·2026-03-30·CVSS 8.6
CVE-2026-34714 [HIGH] CVE-2026-34714: Vim before 9
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
GHSA
GHSA-mfxw-q267-mgp6: Vim before 9
ghsa_unreviewed·2026-03-30
CVE-2026-34714 [CRITICAL] CWE-78 GHSA-mfxw-q267-mgp6: Vim before 9
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More
blogs_hackernews·2026-04-06
⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More
This week had real hits. The key software got tampered with. Active bugs showed up in the tools people use every day. Some attacks didn’t even need much effort because the path was already there.
One weak spot now spreads wider than before. What starts small can reach a lot of systems fast. New bugs, faster use, less time to react.
That’s this week. Read through it.
## ⚡ Threat of the Week
Axios npm Package Compromised by N. Korean Hackers —Threat actors with ties to North Korea seized control of the npm account belonging to the lead m
Wiz
CVE-2026-34714 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-34714 [MEDIUM] CVE-2026-34714 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34714 :
Vim vulnerability analysis and mitigation
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
Source : NVD
## 8.6
Score
Published March 30, 2026
Severity HIGH
CNA Score 9.2
Affected Technologies
Vim
Linux Fedora
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.5
Exploitation Probability (EPSS) N/A
Affected packages and libraries
vim-enhanced-debuginfo
vim-debuginfo
Sources
Alpine 3.23, edge Severity HIGH Has Fix Added at: Apr 02, 2026
Chainguard Has Fix Added at: Mar 31, 2026
Debian 11, 12, 13 Severity CRITICAL No Fix Added
Wiz
CVE-2026-28422 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 2.2
CVE-2026-28422 [LOW] CVE-2026-28422 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28422 :
Vim vulnerability analysis and mitigation
build_stl_str_hl()
Source : NVD
## 2.2
Score
Published February 27, 2026
Severity LOW
CNA Score 2.2
Affected Technologies
Vim
Linux Fedora
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
vim-X11-debuginfo
vim-debuginfo
Sources
Alpine 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22 Severity LOW Has Fix Added at: Mar 08, 2026
Alpine 3.23, edge Severity LOW Has Fix Added at: Mar 02, 2026
CBL-Mariner 2.0 Severity LOW Has Fix Added at: Mar 10, 2026
CBL-Mariner 3.0 Severity LOW Has Fix Added at: Mar 13, 2026
Chainguard H
Wiz
CVE-2026-28419 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-28419 [MEDIUM] CVE-2026-28419 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28419 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.
Source : NVD
## 6.6
Score
Published February 27, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Vim
Alma Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
vim-filesystem
vim-X11
Sources
Wiz
CVE-2026-25749 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.6
CVE-2026-25749 [MEDIUM] CVE-2026-25749 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25749 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.
Source : NVD
## 6.6
Score
Published February 6, 2026
Severity MEDIUM
CNA Score 6.6
Affected Technologies
Vim
Rocky Linux
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Re
Wiz
CVE-2026-28420 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.4
CVE-2026-28420 [MEDIUM] CVE-2026-28420 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28420 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.
Source : NVD
## 4.4
Score
Published February 27, 2026
Severity MEDIUM
CNA Score 4.4
Affected Technologies
Vim
Alma Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
vim-common
vim-minimal
Sources
Alpine 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.
Wiz
CVE-2026-32249 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-32249 [MEDIUM] CVE-2026-32249 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-32249 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
Source : NVD
## 5.5
Score
Published March 12, 2026
Severity MEDIUM
CNA Score 5.3
A
Wiz
CVE-2026-28421 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-28421 [MEDIUM] CVE-2026-28421 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28421 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.
Source : NVD
## 7.8
Score
Published February 27, 2026
Severity HIGH
CNA Score 5.3
Affected Technologies
Vim
Alma Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
vim-default-editor
xxd
Sources
Alpine 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17
Wiz
CVE-2026-35177 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.1
CVE-2026-35177 [MEDIUM] CVE-2026-35177 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35177 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives, circumventing the previous fix for CVE-2025-53906. This vulnerability is fixed in 9.2.0280.
Source : NVD
## 4.1
Score
Published April 6, 2026
Severity MEDIUM
CNA Score 4.1
Affected Technologies
Vim
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3.7
Exploitation Probability (EPSS) N/A
Affected packages and libraries
vim-data
xxd
Sources
NVD
Alpine 3.23, edge Severity MEDIUM Has Fix Added at: Apr 02, 2026
De
Wiz
CVE-2026-26269 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.4
CVE-2026-26269 [MEDIUM] CVE-2026-26269 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26269 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148.
Source : NVD
## 7.5
Score
Published February 13, 2026
Severity HIGH
CNA Score 5.4
Affected Technologies
Vim
Alma Linux
Has Public Exploit No
Has CISA KEV Exp
Wiz
CVE-2026-34982 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-34982 [MEDIUM] CVE-2026-34982 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34982 :
Vim vulnerability analysis and mitigation
complete
guitabtooltip
printheader
P_MLE
mapset()
check_secure()
Source : NVD
## 8.2
Score
Published April 6, 2026
Severity HIGH
CNA Score 8.2
Affected Technologies
Vim
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
vim
vim-common
Sources
NVD
Alpine 3.23, edge Severity HIGH Has Fix Added at: Apr 02, 2026
Debian 11, 12, 13, 14 Severity HIGH No Fix Added at: Apr 02, 2026
Echo Severity HIGH No Fix Added at: Apr 02, 2026
Red Hat 6, 7, 8, 9 Severity HIGH No Fix Added at: Apr 06, 2026
Red Hat 10 Severity HIGH No Fix Added at: Ap
Wiz
CVE-2026-33412 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.6
CVE-2026-33412 [MEDIUM] CVE-2026-33412 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33412 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has been patched in version 9.2.0202.
Source : NVD
## 7.3
Score
Published March 24, 2026
Severity HIGH
CNA Score 5.6
Affected Technologies
Vim
Linux Fedora
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.9
Exploitation Probability (EPSS) N/A
Affected packages and
Wiz
CVE-2026-28418 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.4
CVE-2026-28418 [MEDIUM] CVE-2026-28418 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28418 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue.
Source : NVD
## 5.5
Score
Published February 27, 2026
Severity MEDIUM
CNA Score 4.4
Affected Technologies
Vim
Alma Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
vim-minimal
vim-X11-debuginfo
Sources
Alpine 3.10,
Wiz
CVE-2026-39881 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.6
CVE-2026-39881 [MEDIUM] CVE-2026-39881 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-39881 :
Vim vulnerability analysis and mitigation
Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.
Source : NVD
## 5
Score
Published April 8, 2026
Severity MEDIUM
CNA Score 5.0
Affected Technologies
Vim
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 33.2
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
cpe:2.3:a:vim:vim
vim
Sources
NVD
Alpine
Wiz
CVE-2026-28417 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.4
CVE-2026-28417 [MEDIUM] CVE-2026-28417 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28417 :
Vim vulnerability analysis and mitigation
netrw
scp://
Source : NVD
## 7.8
Score
Published February 27, 2026
Severity HIGH
CNA Score 4.4
Affected Technologies
Vim
Alma Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
vim-X11
vim-common
Sources
Alpine 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22 Severity HIGH Has Fix Added at: Mar 03, 2026
Alpine 3.23, edge Severity HIGH Has Fix Added at: Mar 02, 2026
CBL-Mariner 2.0 Severity MEDIUM Has Fix Added at: Mar 10, 2026
CBL-Mariner 3.0 Severity MEDIUM Has Fix Added at: Mar 13, 2026
Chainguard Has Fix Adde
Bugzilla
CVE-2026-34714 vim: Vim: Arbitrary code execution via crafted file [fedora-all]
bugzilla·2026-03-30·CVSS 9.2
CVE-2026-34714 [CRITICAL] CVE-2026-34714 vim: Vim: Arbitrary code execution via crafted file [fedora-all]
CVE-2026-34714 vim: Vim: Arbitrary code execution via crafted file [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-86867aff2e (vim-9.2.272-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-86867aff2e
---
FEDORA-2026-86867aff2e has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-86867aff2e`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updat
Bugzilla
CVE-2026-34714 vim: Vim: Arbitrary code execution via crafted file
bugzilla·2026-03-30·CVSS 8.6
CVE-2026-34714 [HIGH] CVE-2026-34714 vim: Vim: Arbitrary code execution via crafted file
CVE-2026-34714 vim: Vim: Arbitrary code execution via crafted file
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459https://github.com/vim/vim/releases/tag/v9.2.0272https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvhhttps://www.openwall.com/lists/oss-security/2026/03/30/3http://www.openwall.com/lists/oss-security/2026/04/02/4http://www.openwall.com/lists/oss-security/2026/04/02/5http://www.openwall.com/lists/oss-security/2026/04/03/6https://access.redhat.com/security/cve/CVE-2026-34714https://bugzilla.redhat.com/show_bug.cgi?id=2453139https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34714.json
2026-03-30
Published