Vulnerability · Published Mar 12, 2026 · Assigned by GitHub_M
CVE-2026-32249NFA regex engine NULL pointer dereference affects Vim < 9.2.0137
Medium 5.3
In plain English
A medium-severity null pointer dereference in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | vim | 9.2.0140-r0 | ALPINE-CVE-2026-32249 |
| Alpine:v3.24 | vim | 9.2.0140-r0 | ALPINE-CVE-2026-32249 |
| Debian:13 | vim | 2:9.1.1230-2+deb13u1 | DEBIAN-CVE-2026-32249 |
| Debian:14 | vim | 2:9.2.0218-1 | DEBIAN-CVE-2026-32249 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.11 | UBUNTU-CVE-2026-32249 |
| Ubuntu:25.10 | vim | 2:9.1.0967-1ubuntu6.2 | UBUNTU-CVE-2026-32249 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/vim/vim/security/advisories/GHSA-9phh-423r-778r x_refsource_CONFIRM
- https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec x_refsource_MISC
- https://github.com/vim/vim/releases/tag/v9.2.0137 x_refsource_MISC