CVE-2026-28422

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-28422
Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.

2.2 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/vim/vim/commit/4e5b9e31cb7484ad156f Patch
https://github.com/vim/vim/releases/tag/v9.2.0078 Product
https://github.com/vim/vim/security/advisories/GHSA-gmqx-prf2-8mwf Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/02/27/11 Mailing List Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*
History

04 Mar 2026, 20:44

Type Values Removed Values Added
References () https://github.com/vim/vim/commit/4e5b9e31cb7484ad156f - () https://github.com/vim/vim/commit/4e5b9e31cb7484ad156f - Patch
References () https://github.com/vim/vim/releases/tag/v9.2.0078 - () https://github.com/vim/vim/releases/tag/v9.2.0078 - Product
References () https://github.com/vim/vim/security/advisories/GHSA-gmqx-prf2-8mwf - () https://github.com/vim/vim/security/advisories/GHSA-gmqx-prf2-8mwf - Patch, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/02/27/11 - () http://www.openwall.com/lists/oss-security/2026/02/27/11 - Mailing List, Patch, Third Party Advisory
First Time Vim vim
Vim
CPE cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*
Summary
  • (es) Vim es un editor de texto de código abierto, de línea de comandos. Antes de la versión 9.2.0078, ocurre un desbordamiento de búfer de pila en 'build_stl_str_hl()' al renderizar una línea de estado con un carácter de relleno multibyte en una terminal muy ancha. La versión 9.2.0078 corrige el problema.

28 Feb 2026, 01:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/02/27/11 -

27 Feb 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-27 22:16

Updated : 2026-03-04 20:44

NVD link : CVE-2026-28422

Mitre link : CVE-2026-28422

CVE.ORG link : CVE-2026-28422

JSON object : View

Products Affected

vim

  • vim
CWE
CWE-121

Stack-based Buffer Overflow