CVE catalog

CVE-2026-39881

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands wh

[CVE catalog]

Severity
Medium · CVSS 6CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.62% · Oct 27, 2026

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianvimsid2:9.2.0858-1fixed
Debianvimforky2:9.2.0858-1fixed
Debianvimtrixie2:9.1.1230-2vulnerable
Debianvimbookworm2:9.0.1378-2+deb12u2vulnerable
CpevimNot reported2:9.1.0016-1ubuntu7.13fixed
Cpevim-athenaNot reported2:9.1.0016-1ubuntu7.13fixed
Cpevim-commonNot reported2:9.1.0016-1ubuntu7.13fixed
Cpevim-docNot reported2:9.1.0016-1ubuntu7.13fixed
Cpevim-gtk3Not reported2:9.1.0016-1ubuntu7.13fixed
Cpevim-gui-commonNot reported2:9.1.0016-1ubuntu7.13fixed
Cpevim-motifNot reported2:9.1.0016-1ubuntu7.13fixed
Cpevim-noxNot reported2:9.1.0016-1ubuntu7.13fixed
Cpevim-runtimeNot reported2:9.1.0016-1ubuntu7.13fixed
Cpevim-tinyNot reported2:9.1.0016-1ubuntu7.13fixed
CpexxdNot reported2:9.1.0016-1ubuntu7.13fixed
CpevimNot reported2:9.1.0016-1ubuntu7.12fixed
Cpevim-athenaNot reported2:9.1.0016-1ubuntu7.12fixed
Cpevim-commonNot reported2:9.1.0016-1ubuntu7.12fixed
Cpevim-docNot reported2:9.1.0016-1ubuntu7.12fixed
Cpevim-gtk3Not reported2:9.1.0016-1ubuntu7.12fixed
Cpevim-gui-commonNot reported2:9.1.0016-1ubuntu7.12fixed
Cpevim-motifNot reported2:9.1.0016-1ubuntu7.12fixed
Cpevim-noxNot reported2:9.1.0016-1ubuntu7.12fixed
Cpevim-runtimeNot reported2:9.1.0016-1ubuntu7.12fixed
Cpevim-tinyNot reported2:9.1.0016-1ubuntu7.12fixed
CpexxdNot reported2:9.1.0016-1ubuntu7.12fixed
CpevimNot reportedNot reportedvulnerable
CpevimNot reported9.2.0316fixed
Alpinevim3.239.2.0321-r0fixed
Susevimlinux micro extras 6.29.2.0530-160000.1.1fixed
Susevimlinux enterprise micro 5.39.2.0530-150000.5.94.1fixed
Susevimlinux enterprise micro 5.49.2.0530-150000.5.94.1fixed
Susevimlinux enterprise high performance computing 15 sp4-espos9.2.0530-150000.5.94.1fixed
Susevimlinux enterprise high performance computing 15 sp4-ltss9.2.0530-150000.5.94.1fixed
Susevimlinux enterprise server 15 sp4-ltss9.2.0530-150000.5.94.1fixed
Susevimlinux enterprise server for sap applications 15 sp49.2.0530-150000.5.94.1fixed
Ubuntuvimpro2:8.1.0875-5ubuntu2vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu3vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu1vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.3vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.6vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.7vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.8vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.9vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.11vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.12vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.13vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.14vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.15vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.16vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.17vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.18vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.20vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.21vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.22vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.23vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.24vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.25vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.26vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.29vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.30vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.31vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm2vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm3vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm4fixed
Ubuntuvim22.042:8.2.2434-3ubuntu3vulnerable
Ubuntuvim22.042:8.2.2434-3ubuntu4vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu3vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.3vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.4vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.7vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.8vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.9vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.10vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.11vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.12vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.13vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.15vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.16vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.17vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.18vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.19vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.20vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.21vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.22vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.23vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.24vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.26vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.27vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.28fixed
Ubuntuvim24.042:9.0.1672-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2087-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2184-0ubuntu1vulnerable
Ubuntuvim24.042:9.0.2189-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.3vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.4vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.5vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.8vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.9vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.10vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.11vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.12fixed
Ubuntuvim25.102:9.1.0967-1ubuntu4vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu5vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.1vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.2vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.3fixed
Ubuntuvim26.042:9.1.0967-1ubuntu6vulnerable
Ubuntuvim26.042:9.1.1882-1ubuntu1vulnerable
Ubuntuvim26.042:9.1.1882-1ubuntu2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu1vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianvimsourcesid2:9.2.0338-1not yet assignedNot reportedNot reported
Debianvimsourceforky2:9.2.0338-1not yet assignedNot reportedNot reported
Debianvimsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianvimsourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpevimcpeNot reported2:9.1.0016-1ubuntu7.13Not reportedNot reportedNot reported
Cpevim-athenacpeNot reported2:9.1.0016-1ubuntu7.13Not reportedNot reportedNot reported
Cpevim-commoncpeNot reported2:9.1.0016-1ubuntu7.13Not reportedNot reportedNot reported
Cpevim-doccpeNot reported2:9.1.0016-1ubuntu7.13Not reportedNot reportedNot reported
Cpevim-gtk3cpeNot reported2:9.1.0016-1ubuntu7.13Not reportedNot reportedNot reported
Cpevim-gui-commoncpeNot reported2:9.1.0016-1ubuntu7.13Not reportedNot reportedNot reported
Cpevim-motifcpeNot reported2:9.1.0016-1ubuntu7.13Not reportedNot reportedNot reported
Cpevim-noxcpeNot reported2:9.1.0016-1ubuntu7.13Not reportedNot reportedNot reported
Cpevim-runtimecpeNot reported2:9.1.0016-1ubuntu7.13Not reportedNot reportedNot reported
Cpevim-tinycpeNot reported2:9.1.0016-1ubuntu7.13Not reportedNot reportedNot reported
CpexxdcpeNot reported2:9.1.0016-1ubuntu7.13Not reportedNot reportedNot reported
CpevimcpeNot reported2:9.1.0016-1ubuntu7.12Not reportedNot reportedNot reported
Cpevim-athenacpeNot reported2:9.1.0016-1ubuntu7.12Not reportedNot reportedNot reported
Cpevim-commoncpeNot reported2:9.1.0016-1ubuntu7.12Not reportedNot reportedNot reported
Cpevim-doccpeNot reported2:9.1.0016-1ubuntu7.12Not reportedNot reportedNot reported
Cpevim-gtk3cpeNot reported2:9.1.0016-1ubuntu7.12Not reportedNot reportedNot reported
Cpevim-gui-commoncpeNot reported2:9.1.0016-1ubuntu7.12Not reportedNot reportedNot reported
Cpevim-motifcpeNot reported2:9.1.0016-1ubuntu7.12Not reportedNot reportedNot reported
Cpevim-noxcpeNot reported2:9.1.0016-1ubuntu7.12Not reportedNot reportedNot reported
Cpevim-runtimecpeNot reported2:9.1.0016-1ubuntu7.12Not reportedNot reportedNot reported
Cpevim-tinycpeNot reported2:9.1.0016-1ubuntu7.12Not reportedNot reportedNot reported
CpexxdcpeNot reported2:9.1.0016-1ubuntu7.12Not reportedNot reportedNot reported
CpevimcpeNot reported9.2.0316Not reportedNot reportedNot reported
Alpinevimapk3.239.2.0321-r0Not reportedALPINE-CVE-2026-39881Not reported
Susevimrpmlinux micro extras 6.29.2.0530-160000.1.1Not reportedSUSE-SU-2026:21833-1Not reported
Susevimrpmlinux enterprise micro 5.39.2.0530-150000.5.94.1Not reportedSUSE-SU-2026:2313-1Not reported
Susevimrpmlinux enterprise micro 5.49.2.0530-150000.5.94.1Not reportedSUSE-SU-2026:2313-1Not reported
Susevimrpmlinux enterprise high performance computing 15 sp4-espos9.2.0530-150000.5.94.1Not reportedSUSE-SU-2026:2313-1Not reported
Susevimrpmlinux enterprise high performance computing 15 sp4-ltss9.2.0530-150000.5.94.1Not reportedSUSE-SU-2026:2313-1Not reported
Susevimrpmlinux enterprise server 15 sp4-ltss9.2.0530-150000.5.94.1Not reportedSUSE-SU-2026:2313-1Not reported
Susevimrpmlinux enterprise server for sap applications 15 sp49.2.0530-150000.5.94.1Not reportedSUSE-SU-2026:2313-1Not reported
Ubuntuvimdebpro2:8.1.2269-1ubuntu5.32+esm4Not reportedUBUNTU-CVE-2026-39881Not reported
Ubuntuvimdeb22.042:8.2.3995-1ubuntu2.28Not reportedUBUNTU-CVE-2026-39881Not reported
Ubuntuvimdeb24.042:9.1.0016-1ubuntu7.12Not reportedUBUNTU-CVE-2026-39881Not reported
Ubuntuvimdeb25.102:9.1.0967-1ubuntu6.3Not reportedUBUNTU-CVE-2026-39881Not reported
Ubuntuvimdeb26.042:9.1.2141-1ubuntu4.1Not reportedUBUNTU-CVE-2026-39881Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [vim]Affected
    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-common]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-tiny]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [xxd]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

[Debian 13 (Trixie)]

  • [vim]Affected
    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-common]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

Next results

Observed:

References