Skip to main content

Vim EUVDEUVD-2026-39448

| CVE-2026-57452 MEDIUM
Out-of-bounds Read (CWE-125)
2026-06-25 GitHub_M
Buffer Overflow Information Disclosure Red Hat Vim Suse
5.5
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malformed VimCrypt~04!/~05! file
  2. Delivery
    Deliver to target via social engineering or shared storage
  3. Exploit
    Target opens file in +sodium Vim build
  4. Execution
    Unsigned underflow in body length calculation
  5. Persist
    Out-of-bounds read in libsodium secretstream pull
  6. Impact
    Vim process crashes

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Two non-default conditions must both be true: (1) Vim must be compiled with the +sodium feature linking against libsodium - many distribution builds omit this; (2) the user must open a file using VimCrypt~04! or VimCrypt~05! encryption (xchacha20poly1305 cipher) whose body section is shorter than crypto_secretstream_xchacha20poly1305_HEADERBYTES. UI:R in the CVSS vector confirms the user must actively open the crafted file; there is no network-reachable attack surface. Exploitation is limited to denial of service (Vim process crash) and does not affect other processes or the host system. Builds of Vim without +sodium are entirely unaffected regardless of file content.
Impact

The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) correctly frames this as a local, user-interaction-dependent denial of service. Real-world risk is meaningfully constrained by two factors: the +sodium feature must be compiled into the Vim binary (not present in all distribution packages), and the user must actively open the crafted file. The availability impact is limited to the Vim process crashing - not the host OS or other processes. EPSS data was not provided in the input; given the local-only, user-interaction-required nature and absence of KEV listing, real-world exploitation probability is likely low. The 'Information Disclosure' tag applied by the reporter is potentially misleading: CWE-125 can theoretically expose process memory during an out-of-bounds read, but the CVSS assessor explicitly set C:N, and the description focuses exclusively on the crash - this discrepancy should be verified against the GitHub advisory. No public exploit code identified at time of analysis. This is a real but low-priority issue for most organizations, elevated only for environments where users routinely open Vim-encrypted files from untrusted sources.
Exploit ScenarioDerived

An attacker crafts a VimCrypt~04!-prefixed file with a valid 36-byte header (12-byte magic, 16-byte salt, 8-byte seed) followed by a body shorter than the 24-byte libsodium secretstream header - as small as 8 bytes - and delivers it to a target user via email attachment, shared filesystem, or download. When the user opens the file in a +sodium-enabled Vim build, the unsigned length underflow triggers an out-of-bounds read in libsodium's pull function, immediately crashing Vim and losing any unsaved work in the session. The GitHub commit includes a byte-exact reproducer (44-byte test file) confirming the crash path is reliably triggered.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 25, 2026

Vim crashes with an out-of-bounds read when opening a maliciously crafted file encrypted with the xchacha20poly1305 cipher (VimCrypt~04! or VimCrypt~05!) whose body is shorter than a libsodium secretstream header. An unsigned integer underflow in the length calculation inside crypt_sodium_buffer_decode() causes the subsequent crypto_secretstream_xchacha20poly1305_pull() call to read far past the end of the input buffer, resulting in a denial-of-service crash. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the fix commit includes a concrete reproducer test case confirming the crash path.

RemediationAI

Upgrade Vim to version 9.2.0671 or later; the patch is confirmed released via GitHub at https://github.com/vim/vim/releases/tag/v9.2.0671 and the fix commit is https://github.com/vim/vim/commit/c8777cec25dcfae89c42e9aff51af61f71c5745f. Distribution packagers (Debian, Ubuntu, Fedora, Arch, Homebrew) should be checked for their own update timelines, as distribution-packaged versions may lag behind upstream. If an immediate upgrade is not possible, a compensating control is to disable use of xchacha20poly1305 encryption (VimCrypt~04! and ~05!) in organizational Vim configurations via 'set cryptmethod=blowfish2' or an earlier method - this trades the sodium cipher's modern security guarantees for removal of the vulnerable code path. Alternatively, restrict opening of Vim-encrypted files from untrusted sources via policy. If your Vim build does not include +sodium (verify with ':version' and checking for '+sodium' vs '-sodium'), you are not vulnerable and no action is needed.

Affected VersionsENISA

vim < 9.2.0671

Affected Packages

euvd vim fix: 9.2.0671

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Vim's optional +sodium build feature exposes libsodium's secretstream API (xchacha20poly1305) for file encryption via the VimCrypt~04! and VimCrypt~05! methods. When pulling a secretstream, libsodium expects at minimum crypto_secretstream_xchacha20poly1305_HEADERBYTES of input before attempting decryption state initialization. The vulnerable code in src/crypt.c at crypt_sodium_buffer_decode() computed the body length as an unsigned integer without first verifying it met the minimum header size, so a file with a very short body caused the subtraction to wrap around to a very large value - a classic CWE-125 (Out-of-bounds Read) triggered by an integer underflow. The commit diff confirms the fix is a single guard clause added before the init_pull call: 'if (len < crypto_secretstream_xchacha20poly1305_HEADERBYTES || ...' ensuring the buffer length is validated before any decryption operation proceeds. The affected CPE is cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* for all versions prior to 9.2.0671.

Know when Vim gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local file open triggers crash with no privilege requirement; UI:R captures mandatory user interaction; no confidentiality or integrity impact confirmed.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 4.7 MEDIUM

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Patch available
Jun 25, 2026 - 17:02 EUVD

DescriptionCVE.org

Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.

Threat Intelligence Overview

EPSS Score
0.1%
Top 98% exploitable
Prevalence
High
Vim ships by default on most Linux/macOS/BSD systems
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2026-34714 HIGH POC
8.6 Mar 30

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2022-1616 HIGH POC
7.8 May 07

Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. Rated high severity (CVSS 7.8), this vu
CVE-2022-1619 HIGH POC
7.8 May 08

Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. Rated high se
CVE-2021-4136 HIGH POC
7.8 Dec 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3973 HIGH POC
7.8 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-3927 HIGH POC
7.8 Nov 05

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2022-2125 HIGH POC
7.8 Jun 19

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability
CVE-2022-2126 HIGH POC
7.8 Jun 19

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Rated high severity (CVSS 7.8), this vulnerability is no a

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:30267 ADVISORY https://ubuntu.com/security/notices/USN-8500-1 ADVISORY https://vuldb.com/vuln/373928 REF https://github.com/vim/vim/commit/c8777cec25dcfae89c42e9aff51af61f71c5745f REF https://github.com/vim/vim/releases/tag/v9.2.0671 REF https://github.com/vim/vim/security/advisories/GHSA-c4j9-wr9j-4486

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy