CVE-2026-25749

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25749
Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.

6.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9 Patch
https://github.com/vim/vim/releases/tag/v9.1.2132 Product
https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43 Exploit Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*
History

20 Feb 2026, 15:45

Type Values Removed Values Added
CPE cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*
First Time Vim vim
Vim
Summary
  • (es) Vim es un editor de texto de código abierto de línea de comandos. Antes de la versión 9.1.2132, existe una vulnerabilidad de desbordamiento de búfer de pila en la lógica de resolución de archivos de etiquetas de Vim al procesar la opción 'helpfile'. La vulnerabilidad se encuentra en la función get_tagfname() en src/tag.c. Al procesar etiquetas de archivos de ayuda, Vim copia el valor de la opción 'helpfile' controlado por el usuario en un búfer de pila de tamaño fijo de MAXPATHL + 1 bytes (típicamente 4097 bytes) utilizando una operación STRCPY() insegura sin ninguna comprobación de límites. Este problema ha sido parcheado en la versión 9.1.2132.
References () https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9 - () https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9 - Patch
References () https://github.com/vim/vim/releases/tag/v9.1.2132 - () https://github.com/vim/vim/releases/tag/v9.1.2132 - Product
References () https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43 - () https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43 - Exploit, Patch, Vendor Advisory

06 Feb 2026, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-06 23:15

Updated : 2026-02-20 15:45

NVD link : CVE-2026-25749

Mitre link : CVE-2026-25749

CVE.ORG link : CVE-2026-25749

JSON object : View

Products Affected

vim

  • vim
CWE
CWE-122

Heap-based Buffer Overflow