Vulnerability · Published Jun 25, 2026 · Assigned by GitHub_M

CVE-2026-57454Vim: Out-of-bounds Read with Text Properties

Medium 6.8

In plain English

A medium-severity out-of-bounds read in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.8Medium

Exploit odds (30 days)0.2%top 93.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property data. When Vim restores or displays such a line it converts the offset into a pointer and reads the virtual text without bounds checking, causing an out-of-bounds read that can crash Vim or disclose adjacent heap memory. This vulnerability is fixed in 9.2.0679.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.23	vim	9.2.0854-r0	ALPINE-CVE-2026-57454
Alpine:v3.24	vim	9.2.0680-r0	ALPINE-CVE-2026-57454
Debian:14	vim	2:9.2.0782-1	DEBIAN-CVE-2026-57454
Ubuntu:22.04:LTS	vim	no fix listed	UBUNTU-CVE-2026-57454
Ubuntu:24.04:LTS	vim	no fix listed	UBUNTU-CVE-2026-57454
Ubuntu:25.10	vim	no fix listed	UBUNTU-CVE-2026-57454
Ubuntu:26.04:LTS	vim	no fix listed	UBUNTU-CVE-2026-57454

Affected products (as reported)

Vendor	Product	Versions
vim	vim	>= 9.2.0320, < 9.2.0679

Weakness: CWE-125 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/vim/vim/security/advisories/GHSA-ww8h-47xp-hp4w x_refsource_CONFIRM
https://github.com/vim/vim/commit/b3faeecc976d3031d7c0675623516ec60c30f949 x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0679 x_refsource_MISC