suse/vim&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

Vulnerabilities (28)

• CVE-2026-46483LowMay 15, 2026
  affected < 9.2.0530-150000.5.94.1fixed 9.2.0530-150000.5.94.1

  Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(

• CVE-2026-45130MedMay 8, 2026
  affected < 9.2.0530-150000.5.94.1fixed 9.2.0530-150000.5.94.1

  Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound se

• CVE-2026-44656MedMay 8, 2026
  affected < 9.2.0530-150000.5.94.1fixed 9.2.0530-150000.5.94.1

  Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion

• CVE-2026-42307MedMay 8, 2026
  affected < 9.2.0530-150000.5.94.1fixed 9.2.0530-150000.5.94.1

  Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can

• CVE-2026-39881MedApr 8, 2026
  affected < 9.2.0530-150000.5.94.1fixed 9.2.0530-150000.5.94.1

  Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and special

• CVE-2026-34982HigApr 6, 2026
  affected < 9.2.0280-150000.5.89.1fixed 9.2.0280-150000.5.89.1

  Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a

• CVE-2026-34714CriMar 30, 2026
  affected < 9.2.0280-150000.5.89.1fixed 9.2.0280-150000.5.89.1

  Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

• CVE-2026-33412Mar 24, 2026
  affected < 9.2.0280-150000.5.89.1fixed 9.2.0280-150000.5.89.1

  Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary sh

• CVE-2026-28422Feb 27, 2026
  affected < 9.2.0110-150000.5.86.1fixed 9.2.0110-150000.5.86.1

  Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.

• CVE-2026-28421Feb 27, 2026
  affected < 9.2.0110-150000.5.86.1fixed 9.2.0110-150000.5.86.1

  Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.

• CVE-2026-28420Feb 27, 2026
  affected < 9.2.0110-150000.5.86.1fixed 9.2.0110-150000.5.86.1

  Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the iss

• CVE-2026-28419Feb 27, 2026
  affected < 9.2.0110-150000.5.86.1fixed 9.2.0110-150000.5.86.1

  Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immed

• CVE-2026-28418Feb 27, 2026
  affected < 9.2.0110-150000.5.86.1fixed 9.2.0110-150000.5.86.1

  Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocat

• CVE-2026-28417Feb 27, 2026
  affected < 9.2.0110-150000.5.86.1fixed 9.2.0110-150000.5.86.1

  Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute

• CVE-2026-26269Feb 13, 2026
  affected < 9.2.0110-150000.5.86.1fixed 9.2.0110-150000.5.86.1

  Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists

• CVE-2025-53906MedJul 15, 2025
  affected < 9.2.0110-150000.5.86.1fixed 9.2.0110-150000.5.86.1

  Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct user interaction. Ho

• CVE-2025-29768MedMar 13, 2025
  affected < 9.1.1406-150000.5.75.1fixed 9.1.1406-150000.5.75.1

  Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been f

• CVE-2024-41965MedAug 1, 2024
  affected < 9.1.1406-150000.5.75.1fixed 9.1.1406-150000.5.75.1

  Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buf

• CVE-2024-22667HigFeb 5, 2024
  affected < 9.1.0111-150000.5.60.1fixed 9.1.0111-150000.5.60.1

  Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

• CVE-2023-48706LowNov 22, 2023
  affected < 9.1.0111-150000.5.60.1fixed 9.1.0111-150000.5.60.1

  Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of m