CVE-2026-57454
Fixed in a distro release EPSS <1%CVSS 6.8
Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property data. When Vim restores or displays such a line it converts the offset into a pointer and reads the virtual text without bounds checking, causing an out-of-bounds read that can crash Vim or disclose adjacent heap memory. This vulnerability is fixed in 9.2.0679.
Products: vim
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.23 | vim | 9.2.0854-r0 |
| Amazon Linux 2023 | vim-common | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | vim-data | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | vim-default-editor | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | vim-enhanced | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | vim-filesystem | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | vim-minimal | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | xxd | 2:9.2.725-1.amzn2023.0.1 |
| Debian 14 | vim | 2:9.2.0782-1 |
| Red Hat hummingbird 1 | vim | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-X11 | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-common | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-data | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-default-editor | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-enhanced | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-filesystem | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-minimal | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | xxd | 0:9.2.967-1.1.hum1 |