CVE-2026-73070

Katalog CVE

CVSS 5.5 · Medium EPSS 0,19%

Kerentanan Stack-based Buffer Overflow pada vim. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

18 September 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vim/vim/security/advisories/GHSA-49m8-wwxj-mr69 patch · advisory vendor
• https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4 patch
• https://github.com/vim/vim/releases/tag/v9.2.0842 product · release notes