EUVD-2026-56225Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Local vector confirmed by socketserver socket access requiring local presence; PR:L required to connect; crash-only impact means no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
4DescriptionCVE.org
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.
AnalysisAI
Use-after-free in Vim's JSON channel parsing (versions 9.2.0511 through 9.2.0843) causes the socketserver process to crash when processing malformed JSON messages that straddle read-buffer boundaries. The stale pointer p in json_decode_item() is invalidated when channel_fill() frees the underlying buffer mid-parse; the error-reporting code then reads freed memory, producing a crash with no code-execution or data-exfiltration potential. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Vim to be started with the socketserver or clientserver channel feature explicitly enabled (e.g., via --clientserver socket --servername channel:PORT), which is a non-default, operator-configured deployment mode. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) accurately reflects a genuine low-severity finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user on a system where Vim is running in socketserver mode connects to the Vim socket and sends a raw JSON payload exceeding 4096 bytes in length, with an invalid Unicode escape sequence (e.g., \uZZZZ) positioned past the first buffer boundary. The oversized message forces a buffer refill mid-parse, freeing the pointer used by the error-reporting path, which then reads freed memory and causes the Vim server process to crash. … |
| Remediation | Upgrade Vim to version 9.2.0844 or later, which incorporates commit f8126294a526aa80c5123eb3079e325daee9ec75 correcting the stale-pointer dereference in src/json.c. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. Rated high severity (CVSS 7.8), this vulnerability i
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. Rated high severity (CVSS 7.8), this vulnerab
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. Rated high severity (CVSS 7.8), this vuln
Use After Free in GitHub repository vim/vim prior to 9.0.1840. Rated high severity (CVSS 7.8), this vulnerability is no
Use After Free in GitHub repository vim/vim prior to 9.0.1857. Rated high severity (CVSS 7.8), this vulnerability is no
Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. Rated high severity (CVSS 7.8), this vulnerability
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. Rated high severity (CVSS 7.8), this vuln
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today