Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-28 | 2 | Disclosure2 |
| 2026-03-08 | 1 | Disclosure1 |
| 2026-04-02 | 2 | Disclosure1Patch1 |
Vim CVE-2026-28421: Heap-based Buffer Overflow and Improper Input Validation in Swap File Recovery CVE-2026-28422: Stack-based Buffer Overflow when rendering a statusline with a multi-byte fill character on a very wide terminal
Post summary
The post announces two CVE disclosures for Vim, detailing heap- and stack-based buffer overflows that affect swap file recovery and statusline rendering.
We reported 14+ unfixed (int) truncation heap overflows in Vim — the exact same pattern as CVE-2026-28421, which was patched in only ONE location. Co-maintainer mattn acknowledged it as "theoretically correct as a vulnerability class." Lead maintainer chrisbra's response? Closed the GitHub Security Advisory and said: "Last warning, next time you will be blocked." No fix. No discussion. Just a ban threat to the security researcher. Full writeup: https://medium.com/@engningarchitect/vims-partial-patch-problem-14-heap-overflows-left-behind-after-cve-2026-28421-95c3b6863642?source=friends_link&sk=3893f7983f44d1c4346396336193e817 #infosec #cybersecurity #vim #vulnerability #CVE #responsibleDisclosure
Post summary
The post highlights that Vim still contains 14+ unfixed integer truncation heap overflow vulnerabilities, referencing a Medium writeup, and notes the absence of a patch or active exploitation evidence.
CVE-2026-28421 fixed ONE (int) truncation in Vim. 14+ identical heap overflows remain. Maintainer closed the GHSA and threatened to ban us. Swap files, undo files, terminal buffers — all attackable. https://medium.com/@engningarchitect/vims-partial-patch-problem-14-heap-overflows-left-behind-after-cve-2026-28421-95c3b6863642?source=friends_link&sk=3893f7983f44d1c4346396336193e817 #infosec #vim
Post summary
CVE‑2026‑28421 has a partial patch addressing one integer truncation bug, but 14 other heap overflows remain attackable; the article linked likely details these vulnerabilities, though no exploit code or active attacks are reported.
CVE-2026-28421 Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recov… https://www.cve.org/CVERecord?id=CVE-2026-28421
Post summary
The CVE details a heap‑buffer‑overflow and SEGV in Vim’s swap file recovery for versions before 9.2.0077.
CVE-2026-28421 Heap-Buffer-Overflow and SEGV Vulnerability in Vim Text E... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28421 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet announces CVE-2026-28421, noting a heap buffer overflow and segmentation fault in Vim, and provides links for further vulnerability details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vim | vim | - | - | - |