Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73071Vim: Use-after-free in JSON Decoding

Low 3.3

In plain English

A low-severity use-after-free in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.1%top 98.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.23	vim	9.2.0854-r0	ALPINE-CVE-2026-73071
Alpine:v3.24	vim	9.2.0854-r0	ALPINE-CVE-2026-73071
Debian:14	vim	2:9.2.0858-1	DEBIAN-CVE-2026-73071
Ubuntu:22.04:LTS	vim	2:8.2.3995-1ubuntu2.35	UBUNTU-CVE-2026-73071
Ubuntu:22.04:LTS	vim	2:8.2.3995-1ubuntu2.35	USN-8657-1
Ubuntu:24.04:LTS	vim	2:9.1.0016-1ubuntu7.19	USN-8657-1
Ubuntu:24.04:LTS	vim	2:9.1.0016-1ubuntu7.19	UBUNTU-CVE-2026-73071
Ubuntu:26.04:LTS	vim	2:9.1.2141-1ubuntu4.8	USN-8657-1
Ubuntu:26.04:LTS	vim	2:9.1.2141-1ubuntu4.8	UBUNTU-CVE-2026-73071

Affected products (as reported)

Vendor	Product	Versions
vim	vim	>= 9.2.0511, < 9.2.0844

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/vim/vim/security/advisories/GHSA-69ch-22ch-r887 x_refsource_CONFIRM
https://github.com/vim/vim/commit/f8126294a526aa80c5123eb3079e325daee9ec75 x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0844 x_refsource_MISC