CVE-2026-73072

Katalog CVE

CVSS 7.3 · High EPSS 0,11%

Kerentanan Heap-based Buffer Overflow pada vim. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,11% peluang dieksploitasi; lebih tinggi dari 1,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64 patch · advisory vendor
• https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a patch
• https://github.com/vim/vim/releases/tag/v9.2.0846 product