CVE catalog

CVE-2026-52859

Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapsh

[CVE catalog]

Severity
Medium · CVSS 6.9
Published
Source
[NVD] · [CVE record]
EPSS
0.30% · Oct 25, 2026

Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianvimsid2:9.2.0858-1fixed
Debianvimforky2:9.2.0858-1fixed
Debianvimtrixie2:9.1.1230-2vulnerable
Debianvimbookworm2:9.0.1378-2+deb12u2vulnerable
CpevimNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-athenaNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-commonNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-docNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-gtk3Not reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-gui-commonNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-motifNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-noxNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-runtimeNot reported2:9.1.0016-1ubuntu7.16fixed
Cpevim-tinyNot reported2:9.1.0016-1ubuntu7.16fixed
CpexxdNot reported2:9.1.0016-1ubuntu7.16fixed
CpevimNot reportedNot reportedvulnerable
CpevimNot reported9.2.0565fixed
Alpinevim3.239.2.0567-r0fixed
Ubuntuvimpro2:8.1.0875-5ubuntu2vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu3vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu1vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.3vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.6vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.7vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.8vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.9vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.11vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.12vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.13vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.14vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.15vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.16vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.17vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.18vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.20vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.21vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.22vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.23vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.24vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.25vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.26vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.29vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.30vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.31vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm2vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm3vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm5vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm6vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm7vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm8fixed
Ubuntuvim22.042:8.2.2434-3ubuntu3vulnerable
Ubuntuvim22.042:8.2.2434-3ubuntu4vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu3vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.3vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.4vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.7vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.8vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.9vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.10vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.11vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.12vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.13vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.15vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.16vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.17vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.18vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.19vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.20vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.21vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.22vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.23vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.24vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.26vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.27vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.28vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.29vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.30vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.31vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.32fixed
Ubuntuvim24.042:9.0.1672-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2087-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2184-0ubuntu1vulnerable
Ubuntuvim24.042:9.0.2189-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.3vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.4vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.5vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.8vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.9vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.10vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.11vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.12vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.13vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.14vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.15vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.16fixed
Ubuntuvim25.102:9.1.0967-1ubuntu4vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu5vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.1vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.2vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.3vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.4vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.5vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.6vulnerable
Ubuntuvim25.102:9.1.0967-1ubuntu6.7fixed
Ubuntuvim26.042:9.1.0967-1ubuntu6vulnerable
Ubuntuvim26.042:9.1.1882-1ubuntu1vulnerable
Ubuntuvim26.042:9.1.1882-1ubuntu2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu1vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.1vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.2vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.3vulnerable
Ubuntuvim26.042:9.1.2141-1ubuntu4.5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianvimsourcesid2:9.2.0782-1unimportantNot reported[1139729]
Debianvimsourceforky2:9.2.0782-1unimportantNot reported[1139729]
Debianvimsourcetrixie(unfixed)unimportantNot reported[1139729]
Debianvimsourcebookworm(unfixed)unimportantNot reported[1139729]
CpevimcpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-athenacpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-commoncpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-doccpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-gtk3cpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-gui-commoncpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-motifcpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-noxcpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-runtimecpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
Cpevim-tinycpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
CpexxdcpeNot reported2:9.1.0016-1ubuntu7.16Not reportedNot reportedNot reported
CpevimcpeNot reported9.2.0565Not reportedNot reportedNot reported
Alpinevimapk3.239.2.0567-r0Not reportedALPINE-CVE-2026-52859Not reported
Ubuntuvimdebpro2:8.1.2269-1ubuntu5.32+esm8Not reportedUBUNTU-CVE-2026-52859Not reported
Ubuntuvimdeb22.042:8.2.3995-1ubuntu2.32Not reportedUBUNTU-CVE-2026-52859Not reported
Ubuntuvimdeb24.042:9.1.0016-1ubuntu7.16Not reportedUBUNTU-CVE-2026-52859Not reported
Ubuntuvimdeb25.102:9.1.0967-1ubuntu6.7Not reportedUBUNTU-CVE-2026-52859Not reported
Ubuntuvimdeb26.042:9.1.2141-1ubuntu4.5Not reportedUBUNTU-CVE-2026-52859Not reported

[Debian bug #1139729]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [vim]Affected
    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [vim-tiny]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

  • [xxd]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · vim · debian · bookworm; nvd · vim · debian · 12

[Debian 13 (Trixie)]

  • [vim]Affected
    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      nvd · vim · debian · 13

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      nvd · vim · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]