CVE catalog

CVE-2026-32249

Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a charac

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.14% · Oct 25, 2026

Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianvimsid2:9.2.0858-1fixed
Debianvimforky2:9.2.0858-1fixed
Debianvimtrixie2:9.1.1230-2vulnerable
Debianvimbookworm2:9.0.1378-2+deb12u2not affected
CpevimNot reported2:9.1.0016-1ubuntu7.11fixed
Cpevim-athenaNot reported2:9.1.0016-1ubuntu7.11fixed
Cpevim-commonNot reported2:9.1.0016-1ubuntu7.11fixed
Cpevim-docNot reported2:9.1.0016-1ubuntu7.11fixed
Cpevim-gtk3Not reported2:9.1.0016-1ubuntu7.11fixed
Cpevim-gui-commonNot reported2:9.1.0016-1ubuntu7.11fixed
Cpevim-motifNot reported2:9.1.0016-1ubuntu7.11fixed
Cpevim-noxNot reported2:9.1.0016-1ubuntu7.11fixed
Cpevim-runtimeNot reported2:9.1.0016-1ubuntu7.11fixed
Cpevim-tinyNot reported2:9.1.0016-1ubuntu7.11fixed
CpexxdNot reported2:9.1.0016-1ubuntu7.11fixed
CpevimNot reportedNot reportednot affected
Alpinevim3.239.2.0140-r0fixed
Ubuntuvimpro2:8.1.0875-5ubuntu2vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu3vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu1vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.3vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.6vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.7vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.8vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.9vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.11vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.12vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.13vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.14vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.15vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.16vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.17vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.18vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.20vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.21vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.22vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.23vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.24vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.25vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.26vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.29vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.30vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.31vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm2vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm3fixed
Ubuntuvim22.042:8.2.2434-3ubuntu3vulnerable
Ubuntuvim22.042:8.2.2434-3ubuntu4vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu3vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.3vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.4vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.7vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.8vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.9vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.10vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.11vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.12vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.13vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.15vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.16vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.17vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.18vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.19vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.20vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.21vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.22vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.23vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.24vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.26vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.27fixed
Ubuntuvim24.042:9.0.1672-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2087-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2184-0ubuntu1vulnerable
Ubuntuvim24.042:9.0.2189-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.3vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.4vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.5vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.8vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.9vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.10vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.11fixed
Ubuntuvim25.102:9.1.0967-1ubuntu4vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu5vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.1vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.2fixed
Ubuntuvim24.042:9.0.1672-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2087-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2184-0ubuntu1vulnerable
Ubuntuvim24.042:9.0.2189-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.3vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.4vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.5vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.8vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.9vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.10vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.11fixed
Ubuntuvim25.102:9.1.0967-1ubuntu4vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu5vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.1vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianvimsourcesid2:9.2.0218-1unimportantNot reported[1130658]
Debianvimsourceforky2:9.2.0218-1unimportantNot reported[1130658]
Debianvimsourcetrixie(unfixed)unimportantNot reported[1130658]
DebianvimsourcebookwormNot affectedunimportantNot reported[1130658]
CpevimcpeNot reported2:9.1.0016-1ubuntu7.11Not reportedNot reportedNot reported
Cpevim-athenacpeNot reported2:9.1.0016-1ubuntu7.11Not reportedNot reportedNot reported
Cpevim-commoncpeNot reported2:9.1.0016-1ubuntu7.11Not reportedNot reportedNot reported
Cpevim-doccpeNot reported2:9.1.0016-1ubuntu7.11Not reportedNot reportedNot reported
Cpevim-gtk3cpeNot reported2:9.1.0016-1ubuntu7.11Not reportedNot reportedNot reported
Cpevim-gui-commoncpeNot reported2:9.1.0016-1ubuntu7.11Not reportedNot reportedNot reported
Cpevim-motifcpeNot reported2:9.1.0016-1ubuntu7.11Not reportedNot reportedNot reported
Cpevim-noxcpeNot reported2:9.1.0016-1ubuntu7.11Not reportedNot reportedNot reported
Cpevim-runtimecpeNot reported2:9.1.0016-1ubuntu7.11Not reportedNot reportedNot reported
Cpevim-tinycpeNot reported2:9.1.0016-1ubuntu7.11Not reportedNot reportedNot reported
CpexxdcpeNot reported2:9.1.0016-1ubuntu7.11Not reportedNot reportedNot reported
Alpinevimapk3.239.2.0140-r0Not reportedALPINE-CVE-2026-32249Not reported
Ubuntuvimdebpro2:8.1.2269-1ubuntu5.32+esm3Not reportedUSN-8171-1Not reported
Ubuntuvimdeb22.042:8.2.3995-1ubuntu2.27Not reportedUSN-8171-1Not reported
Ubuntuvimdeb24.042:9.1.0016-1ubuntu7.11Not reportedUSN-8171-1Not reported
Ubuntuvimdeb25.102:9.1.0967-1ubuntu6.2Not reportedUSN-8171-1Not reported
Ubuntuvimdeb24.042:9.1.0016-1ubuntu7.11Not reportedUBUNTU-CVE-2026-32249Not reported
Ubuntuvimdeb25.102:9.1.0967-1ubuntu6.2Not reportedUBUNTU-CVE-2026-32249Not reported

[Debian bug #1130658]

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [vim]Affected
    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-tiny]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [xxd]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

[Debian 12 (Bookworm)]

  • [vim]Not affected
    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Not affected

      nvd · vim · debian · bookworm

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Not affected

      nvd · vim · debian · bookworm

  • [vim-athena]Not affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Not affected

      nvd · vim · debian · bookworm

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Not affected

      nvd · vim · debian · bookworm

  • [vim-common]Not affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Not affected

      nvd · vim · debian · bookworm

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Not affected

      nvd · vim · debian · bookworm

  • [vim-doc]Not affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Not affected

      nvd · vim · debian · bookworm

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Not affected

      nvd · vim · debian · bookworm

  • [vim-gtk3]Not affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Not affected

      nvd · vim · debian · bookworm

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Not affected

      nvd · vim · debian · bookworm

  • [vim-gui-common]Not affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Not affected

      nvd · vim · debian · bookworm

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Not affected

      nvd · vim · debian · bookworm

  • [vim-motif]Not affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Not affected

      nvd · vim · debian · bookworm

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Not affected

      nvd · vim · debian · bookworm

  • [vim-nox]Not affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Not affected

      nvd · vim · debian · bookworm

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Not affected

      nvd · vim · debian · bookworm

  • [vim-runtime]Not affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Not affected

      nvd · vim · debian · bookworm

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Not affected

      nvd · vim · debian · bookworm

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]