Vim CVE-2026-73071

Exploitation requires Vim to be started with the socketserver or clientserver channel feature explicitly enabled (e.g., via --clientserver socket --servername channel:PORT), which is a non-default, operator-configured deployment mode. The attacker must be able to connect to the Vim socket - typically requiring local system access or, if the socket is bound to a routable address rather than loopback, network access. The malicious payload must exceed 4096 bytes (MAXMSGSIZE) so the JSON string crosses a buffer boundary, and must contain an invalid JSON construct (such as a broken \u escape) after that boundary to trigger the error path. Standard interactive Vim sessions, including plugins that read JSON files, do not invoke this code path. Windows builds are not affected per the test suite constraints.

The CVSS 3.1 base score of 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) accurately reflects a genuine low-severity finding. The local attack vector is consistent with Vim's socketserver typically binding to a local socket or loopback address rather than an externally routable interface. The impact is confined strictly to availability - a server crash - with no confidentiality or integrity implications per the CVSS vector. Notably, the source data tags this vulnerability as 'Information Disclosure,' which conflicts with C:N in the CVSS vector; reading freed memory on an error path could theoretically expose heap content, but the official assessment assigns no confidentiality impact and the commit diff supports that conclusion. No EPSS data was provided. The absence of a KEV entry, the local attack vector, the non-default socketserver configuration requirement, and the crash-only impact collectively place this at low operational priority for most environments. SSVC signals: exploitation is unconfirmed, the attack is not automatable at scale, and technical impact is partial availability only.

A local user on a system where Vim is running in socketserver mode connects to the Vim socket and sends a raw JSON payload exceeding 4096 bytes in length, with an invalid Unicode escape sequence (e.g., \uZZZZ) positioned past the first buffer boundary. The oversized message forces a buffer refill mid-parse, freeing the pointer used by the error-reporting path, which then reads freed memory and causes the Vim server process to crash. No independent public exploit code is known, but the commit's test function provides a functional reproduction pattern.