CVE catalog

CVE-2026-26269

Vim vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 27, 2026

Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianvimsid2:9.2.0858-1fixed
Debianvimforky2:9.2.0858-1fixed
Debianvimtrixie2:9.1.1230-2vulnerable
Debianvimbookworm2:9.0.1378-2+deb12u2vulnerable
UbuntuvimnobleNot reportedvulnerable
Ubuntuvimnoble2:9.1.0016-1ubuntu7.10fixed
Ubuntuvim-athenanoble2:9.1.0016-1ubuntu7.10fixed
Ubuntuvim-commonnoble2:9.1.0016-1ubuntu7.10fixed
Ubuntuvim-docnoble2:9.1.0016-1ubuntu7.10fixed
Ubuntuvim-gtk3noble2:9.1.0016-1ubuntu7.10fixed
Ubuntuvim-gui-commonnoble2:9.1.0016-1ubuntu7.10fixed
Ubuntuvim-motifnoble2:9.1.0016-1ubuntu7.10fixed
Ubuntuvim-noxnoble2:9.1.0016-1ubuntu7.10fixed
Ubuntuvim-runtimenoble2:9.1.0016-1ubuntu7.10fixed
Ubuntuvim-tinynoble2:9.1.0016-1ubuntu7.10fixed
Ubuntuxxdnoble2:9.1.0016-1ubuntu7.10fixed
Ubuntuvimpro2:8.1.0875-5ubuntu2vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu3vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu1vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.3vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.6vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.7vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.8vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.9vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.11vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.12vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.13vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.14vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.15vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.16vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.17vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.18vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.20vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.21vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.22vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.23vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.24vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.25vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.26vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.29vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.30vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.31vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm2fixed
Ubuntuvim22.042:8.2.2434-3ubuntu3vulnerable
Ubuntuvim22.042:8.2.2434-3ubuntu4vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu3vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.3vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.4vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.7vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.8vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.9vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.10vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.11vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.12vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.13vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.15vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.16vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.17vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.18vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.19vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.20vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.21vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.22vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.23vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.24vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.26fixed
Ubuntuvim24.042:9.0.1672-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2087-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2184-0ubuntu1vulnerable
Ubuntuvim24.042:9.0.2189-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.3vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.4vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.5vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.8vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.9vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.10fixed
Ubuntuvim25.102:9.1.0967-1ubuntu4vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu5vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.1fixed
Ubuntuvim26.042:9.1.0967-1ubuntu6vulnerable
Ubuntuvim26.042:9.1.1882-1ubuntu1vulnerable
Ubuntuvim26.042:9.1.1882-1ubuntu2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu1vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianvimsourcesid2:9.2.0119-1not yet assignedNot reported[1127930]
Debianvimsourceforky2:9.2.0119-1not yet assignedNot reported[1127930]
Debianvimsourcetrixie(unfixed)not yet assignedNot reported[1127930]
Debianvimsourcebookworm(unfixed)not yet assignedNot reported[1127930]
Ubuntuvimdebnoble2:9.1.0016-1ubuntu7.10Not reportedNot reportedNot reported
Ubuntuvim-athenadebnoble2:9.1.0016-1ubuntu7.10Not reportedNot reportedNot reported
Ubuntuvim-commondebnoble2:9.1.0016-1ubuntu7.10Not reportedNot reportedNot reported
Ubuntuvim-docdebnoble2:9.1.0016-1ubuntu7.10Not reportedNot reportedNot reported
Ubuntuvim-gtk3debnoble2:9.1.0016-1ubuntu7.10Not reportedNot reportedNot reported
Ubuntuvim-gui-commondebnoble2:9.1.0016-1ubuntu7.10Not reportedNot reportedNot reported
Ubuntuvim-motifdebnoble2:9.1.0016-1ubuntu7.10Not reportedNot reportedNot reported
Ubuntuvim-noxdebnoble2:9.1.0016-1ubuntu7.10Not reportedNot reportedNot reported
Ubuntuvim-runtimedebnoble2:9.1.0016-1ubuntu7.10Not reportedNot reportedNot reported
Ubuntuvim-tinydebnoble2:9.1.0016-1ubuntu7.10Not reportedNot reportedNot reported
Ubuntuxxddebnoble2:9.1.0016-1ubuntu7.10Not reportedNot reportedNot reported
Ubuntuvimdebpro2:8.1.2269-1ubuntu5.32+esm2Not reportedUBUNTU-CVE-2026-26269Not reported
Ubuntuvimdeb22.042:8.2.3995-1ubuntu2.26Not reportedUBUNTU-CVE-2026-26269Not reported
Ubuntuvimdeb24.042:9.1.0016-1ubuntu7.10Not reportedUBUNTU-CVE-2026-26269Not reported
Ubuntuvimdeb25.102:9.1.0967-1ubuntu6.1Not reportedUBUNTU-CVE-2026-26269Not reported
Ubuntuvimdeb26.042:9.1.2141-1ubuntu2Not reportedUBUNTU-CVE-2026-26269Not reported

[Debian bug #1127930]

Notes

[trixie] vim: Minor issue [bookworm] vim: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [vim]Affected
    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-tiny]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [xxd]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

[Debian 13 (Trixie)]

  • [vim]Affected
    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      usn · vim · debian · 13

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

  • [vim-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      usn · vim · debian · 13

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      usn · vim · debian · 13

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      usn · vim · debian · 13

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]