Skip to main content

Vim CVE-2026-34714

| EUVDEUVD-2026-17160 HIGH
OS Command Injection (CWE-78)
2026-03-30 mitre GHSA-mfxw-q267-mgp6
Command Injection RCE Vim
8.6
CVSS 3.1 · NVD
Temporal: 9.2
Share

Severity by source

NVD PRIMARY
8.6 HIGH
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CIRCL (temporal)
9.2 CRITICAL
cvss
vuln.today AI
8.6 HIGH

Trigger is opening a local file (AV:L, UI:R) with no auth (PR:N) in default config (AC:L); expression eval escapes the editor sandbox (S:C) yielding full code execution (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
9.2 CRITICAL
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Red Hat
8.6 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

11
Analysis Updated
Jun 25, 2026 - 14:58 vuln.today
v3 (cvss_changed)
Source Code Evidence Fetched
Jun 25, 2026 - 14:58 vuln.today
Analysis Updated
Jun 25, 2026 - 14:58 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 25, 2026 - 14:52 vuln.today
cvss_changed
Severity Changed
Jun 25, 2026 - 14:52 NVD
CRITICAL HIGH
CVSS changed
Jun 25, 2026 - 14:52 NVD
9.2 (CRITICAL) 8.6 (HIGH)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 30, 2026 - 18:45 euvd
EUVD-2026-17160
Analysis Generated
Mar 30, 2026 - 18:45 vuln.today
CVE Published
Mar 30, 2026 - 18:27 nvd
HIGH 8.6
CVE Published
Mar 30, 2026 - 18:27 nvd
CRITICAL 9.2

DescriptionNVD

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

AnalysisAI

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon opening a crafted file under default configuration. The flaw stems from an expression injection in the tabpanel option, which lacked the P_MLE flag, enabling %{expr} in modelines without the usual restriction. A publicly available exploit exists, but no active exploitation has been confirmed per CISA KEV.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2023-4735 HIGH POC
7.8 Sep 02

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. Rated high severity (CVSS 7.8), this vulnerability i
CVE-2023-4781 HIGH POC
7.8 Sep 05

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. Rated high severity (CVSS 7.8), this vulnerab
CVE-2023-4734 HIGH POC
7.8 Sep 02

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. Rated high severity (CVSS 7.8), this vuln
CVE-2023-4733 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1840. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4750 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1857. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4736 HIGH POC
7.8 Sep 02

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-2610 HIGH POC
7.8 May 09

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. Rated high severity (CVSS 7.8), this vuln
CVE-2021-4019 HIGH POC
7.8 Dec 01

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

Debian

vim
Release Status Fixed Version Urgency
bullseye vulnerable 2:8.2.2434-3+deb11u1 -
bullseye (security) vulnerable 2:8.2.2434-3+deb11u3 -
bookworm vulnerable 2:9.0.1378-2+deb12u2 -
trixie vulnerable 2:9.1.1230-2 -
forky, sid vulnerable 2:9.2.0218-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: Critical
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.162 Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.95 Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.91 Affected
Container suse/sle-micro-rancher/5.2:latest Affected
Container suse/sle-micro/5.2/toolbox:14.2-7.11.272 Affected

Share

CVE-2026-34714 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy