Vulnerability Description
Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property data. When Vim restores or displays such a line it converts the offset into a pointer and reads the virtual text without bounds checking, causing an out-of-bounds read that can crash Vim or disclose adjacent heap memory. This vulnerability is fixed in 9.2.0679.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vim | Vim | >= 9.2.0320, < 9.2.0679 |
Related Weaknesses (CWE)
References
- https://github.com/vim/vim/commit/b3faeecc976d3031d7c0675623516ec60c30f949Patch
- https://github.com/vim/vim/releases/tag/v9.2.0679Product
- https://github.com/vim/vim/security/advisories/GHSA-ww8h-47xp-hp4wVendor Advisory
FAQ
What is CVE-2026-57454?
CVE-2026-57454 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property d...
How severe is CVE-2026-57454?
CVE-2026-57454 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-57454?
Check the references section above for vendor advisories and patch information. Affected products include: Vim Vim.