Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-06 | 1 | Disclosure1 |
| 2026-03-18 | 1 | Patch1 |
CVE-2026-25749 Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when proces… https://www.cve.org/CVERecord?id=CVE-2026-25749
Post summary
A heap buffer overflow vulnerability was identified in Vim prior to version 9.1.2132, with no additional details about PoC, exploits, or patches provided.
Vim flaws in Ubuntu 14.04-25.10 and SUSE allow DoS and code execution (CVE-2026-25749, -26269, -28417). Patches available 2026-03-18, admins should update affected systems now. #Linux https://threatcluster.io/cluster/multiple-cves-found-in-vim-affecting-ubuntu-and-suse-systems-6e87a209
Post summary
The message announces three Vim CVEs affecting Ubuntu and SUSE that allow DoS and code execution, and urges administrators to apply the patches released on 2026‑03‑18.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | neovim | neovim | - | - | - |
| App | vim | vim | - | - | - |