Unrated severityNVD Advisory· Published Jun 26, 2026
Debian vim: Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a…
CVE-2026-57454
Description
Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property data. When Vim restores or displays such a line it converts the offset into a pointer and reads the virtual text without bounds checking, causing an out-of-bounds read that can crash Vim or disclose adjacent heap memory. This vulnerability is fixed in 9.2.0679.
Affected products
1Patches
Vulnerability mechanics
News mentions
0No linked articles in our index yet.