Vim EUVD-2026-36283

Exploitation requires the victim to be running a Vim build compiled with +terminal support and to have an active :terminal window open in which a program is rendering attacker-controlled output. The specific triggering condition is output containing a Unicode base character combined with five combining marks, which causes libvterm to populate all six cell.chars[] slots without a NUL terminator - a condition reproducible with a short, non-scripted byte sequence as confirmed by the test sample added in the patch commit. No Vim scripting knowledge, plugins, authentication, or elevated privileges are required on the attacker's side; the attacker's influence need only extend to the text content displayed by the terminal program (e.g., data returned by a networked service, output of an untrusted binary). Users who do not use Vim's :terminal feature, or who use it exclusively with fully trusted local programs whose output cannot be influenced by external parties, are not at practical risk regardless of Vim version.

The reporter-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L, score 6.9) characterizes this as a zero-friction, network-reachable, unauthenticated crash - a characterization that is technically defensible but contextually optimistic. In practice, an attacker must have influence over the text output rendered by a program running inside the victim's active :terminal window, which implies an intermediate dependency (e.g., an SSH session to a hostile system, a malicious tool whose output Vim is displaying) that the AV:N/UI:N framing does not fully capture. This implicit user-context dependency meaningfully reduces the realistic attacker population. The vulnerability is absent from CISA's KEV catalog, no public exploit code has been identified, and no EPSS data was provided in the input - all signals consistent with low exploitation urgency. The primary impact is process-level denial of service (crash); the confidentiality impact is limited to whatever adjacent memory happens to be read past the array boundary, and there is no integrity impact. The principal risk population is developers and sysadmins who routinely use Vim's :terminal to run tools that process externally sourced data such as SSH clients, log streamers, or IRC/chat clients. For users who do not use :terminal or use it only with fully trusted local programs, effective risk is negligible.

A developer uses Vim's :terminal to run an SSH session connected to a remote server that an attacker controls or has compromised. The attacker's server outputs a short byte sequence - a base Unicode character followed by five combining marks - which libvterm renders by filling all six cell.chars[] slots without a NUL terminator. When Vim's update_snapshot() processes the cell during scrollback capture, the unguarded loop walks past the array boundary, appending out-of-bounds memory into the scrollback buffer and crashing the Vim process, potentially leaking adjacent stack or heap content in the process.