CVE-2026-28418

Katalog CVE

CVSS 5.5 · Medium EPSS 0,22%

Kerentanan Heap-based Buffer Overflow pada vim. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 12,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vim/vim/security/advisories/GHSA-h4mf-vg97-hj8j patch · advisory vendor
• https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb patch
• http://www.openwall.com/lists/oss-security/2026/02/27/7 mailing list · patch · advisory pihak ketiga
• https://github.com/vim/vim/releases/tag/v9.2.0074 release notes