Skip to main content

Vim CVE-2026-34714

| EUVDEUVD-2026-17160 HIGH
OS Command Injection (CWE-78)
2026-03-30 mitre GHSA-mfxw-q267-mgp6
RCE Command Injection Vim
8.6
CVSS 3.1 · NVD
Temporal: 9.2
View

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 27, 2026

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon opening a crafted file under default configuration. The flaw stems from an expression injection in the tabpanel option, which lacked the P_MLE flag, enabling %{expr} in modelines without the usual restriction. A publicly available exploit exists, but no active exploitation has been confirmed per CISA KEV.

Affected VersionsENISA

vim 0 <9.2.0272

Affected Packages

euvd vim fix: 9.2.0272

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Vim gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.6 HIGH
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CIRCL (temporal) 9.2 CRITICAL
vuln.today AI 8.6 HIGH

Trigger is opening a local file (AV:L, UI:R) with no auth (PR:N) in default config (AC:L); expression eval escapes the editor sandbox (S:C) yielding full code execution (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 9.2 CRITICAL
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Red Hat 8.6 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Severity Changed
Jun 25, 2026 - 14:52 NVD
CRITICAL HIGH
CVSS changed
Jun 25, 2026 - 14:52 NVD
9.2 (CRITICAL) 8.6 (HIGH)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 30, 2026 - 18:27 nvd
HIGH 8.6
CVE Published
Mar 30, 2026 - 18:27 nvd
CRITICAL 9.2

DescriptionNVD

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Threat Intelligence Overview

EPSS Score
0.0%
Top 94% exploitable
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

63
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +43
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2022-1616 HIGH POC
7.8 May 07

Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. Rated high severity (CVSS 7.8), this vu
CVE-2022-1619 HIGH POC
7.8 May 08

Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. Rated high se
CVE-2021-4136 HIGH POC
7.8 Dec 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3973 HIGH POC
7.8 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3927 HIGH POC
7.8 Nov 05

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2022-2125 HIGH POC
7.8 Jun 19

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability
CVE-2022-2126 HIGH POC
7.8 Jun 19

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability is no a
CVE-2022-2124 HIGH POC
7.8 Jun 19

Buffer Over-read in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability is no aut

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

Debian

vim
Release Status Fixed Version Urgency
bullseye vulnerable 2:8.2.2434-3+deb11u1 -
bullseye (security) vulnerable 2:8.2.2434-3+deb11u3 -
bookworm vulnerable 2:9.0.1378-2+deb12u2 -
trixie vulnerable 2:9.1.1230-2 -
forky, sid vulnerable 2:9.2.0218-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: Critical
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.162 Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.95 Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.91 Affected
Container suse/sle-micro-rancher/5.2:latest Affected
Container suse/sle-micro/5.2/toolbox:14.2-7.11.272 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34714 ADVISORY https://vuldb.com/vuln/354239 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1347/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1387/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21118/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21124/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21132/ REF http://www.openwall.com/lists/oss-security/2026/04/02/4 REF http://www.openwall.com/lists/oss-security/2026/04/02/5 REF http://www.openwall.com/lists/oss-security/2026/04/03/6 REF https://access.redhat.com/security/cve/CVE-2026-34714 REF https://bugzilla.redhat.com/show_bug.cgi?id=2453139 REF https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459 REF https://github.com/vim/vim/releases/tag/v9.2.0272 REF https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34714.json REF https://www.openwall.com/lists/oss-security/2026/03/30/3

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy