Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M
CVE-2026-25749Heap Overflow in Vim
Medium 6.6
In plain English
A medium-severity heap buffer overflow in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | vim-X11 | 2:8.0.1763-22.el8_10 | ALSA-2026:4442 |
| AlmaLinux:9 | vim-X11 | 2:8.2.2637-23.el9_7.1 | ALSA-2026:5602 |
| AlmaLinux:8 | vim-common | 2:8.0.1763-22.el8_10 | ALSA-2026:4442 |
| AlmaLinux:9 | vim-common | 2:8.2.2637-23.el9_7.1 | ALSA-2026:5602 |
| AlmaLinux:10 | vim-data | 2:9.1.083-6.el10_1.1 | ALSA-2026:4715 |
| AlmaLinux:8 | vim-enhanced | 2:8.0.1763-22.el8_10 | ALSA-2026:4442 |
| AlmaLinux:9 | vim-enhanced | 2:8.2.2637-23.el9_7.1 | ALSA-2026:5602 |
| AlmaLinux:10 | vim-filesystem | 2:9.1.083-6.el10_1.1 | ALSA-2026:4715 |
| AlmaLinux:8 | vim-filesystem | 2:8.0.1763-22.el8_10 | ALSA-2026:4442 |
| AlmaLinux:9 | vim-filesystem | 2:8.2.2637-23.el9_7.1 | ALSA-2026:5602 |
| AlmaLinux:8 | vim-minimal | 2:8.0.1763-22.el8_10 | ALSA-2026:4442 |
| AlmaLinux:9 | vim-minimal | 2:8.2.2637-23.el9_7.1 | ALSA-2026:5602 |
| Alpine:v3.23 | vim | 9.1.2132-r0 | ALPINE-CVE-2026-25749 |
| Alpine:v3.24 | vim | 9.1.2132-r0 | ALPINE-CVE-2026-25749 |
| Debian:12 | vim | no fix listed | DEBIAN-CVE-2026-25749 |
| Debian:13 | vim | 2:9.1.1230-2+deb13u1 | DEBIAN-CVE-2026-25749 |
| Debian:14 | vim | 2:9.1.2141-1 | DEBIAN-CVE-2026-25749 |
| Rocky Linux:10 | vim | 2:9.1.083-6.el10_1.1 | RLSA-2026:4715 |
| Rocky Linux:8 | vim | 2:8.0.1763-22.el8_10 | RLSA-2026:4442 |
| Rocky Linux:9 | vim | 2:8.2.2637-23.el9_7.1 | RLSA-2026:5602 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.26 | UBUNTU-CVE-2026-25749 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.10 | UBUNTU-CVE-2026-25749 |
| Ubuntu:25.10 | vim | 2:9.1.0967-1ubuntu6.1 | UBUNTU-CVE-2026-25749 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
References
- https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43 x_refsource_CONFIRM
- https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9 x_refsource_MISC
- https://github.com/vim/vim/releases/tag/v9.1.2132 x_refsource_MISC