CVE-2026-57452

Katalog CVE

CVSS 5.5 · Medium EPSS 0,17%

Kerentanan Out-of-bounds Read pada vim. Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-191: Integer Underflow (Wrap or Wraparound)

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vim/vim/security/advisories/GHSA-c4j9-wr9j-4486 advisory vendor
• https://github.com/vim/vim/commit/c8777cec25dcfae89c42e9aff51af61f71c5745f patch
• https://github.com/vim/vim/releases/tag/v9.2.0671 product