CVE-2026-32249Disclosure(vim / vim)

LOWCVSS 5.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch vim vim systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.

vim CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec

Vendor / third-party advisories

https://github.com/vim/vim/security/advisories/GHSA-9phh-423r-778r

Other references

https://github.com/vim/vim/releases/tag/v9.2.0137

Weakness type (CWE)

CWE-476

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-03-12); latest day: 1
5 total mentions across 3 days

Affected systems

Vendors

vim

Products

vim

Deep dive

Activity timeline5 mentions / 3d

Signal classification3 categories

Disclosure

360.0%

General

120.0%

Patch

120.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-12	2	Disclosure2
2026-03-17	2	Disclosure1General1
2026-04-15	1	Patch1

Full discourse5 posts

Rahisisi@Hapankaalimehu178d
Patch
CVE-2026-32249 "A flaw was found in Vim. ... an attacker needs to be able to supply a malicious regex pattern" CVE-2026-33412 "newline character in a pattern passed to Vim's glob() function, an attacker may be able to execute arbitrary shell commands." Debian, RH patched
Post summary
Two Vim vulnerabilities (CVE‑2026‑32249 and CVE‑2026‑33412) permit attackers to supply malicious regex or glob patterns that can lead to arbitrary code execution; Debian and Red Hat have released patches for both.
0000039
430 followersView on X
geoffrey_gordon_ashbrook@GG_Ashbrook208d
General
CVE-2026-32249 yet another ex/vi/vim CVE nvd.nist .gov/vuln/detail/CVE-2026-32249 https://nvd.nist.gov/vuln/detail/CVE-2026-32249
Post summary
The brief mention only identifies CVE-2026-32249 and provides a link to the NVD entry, lacking further technical detail, patch info, or exploitation context.
0000082
85 followersView on X
Ferramentas Linux@Cezar_H_Linux208d
Disclosure
The #Fedora Project has just released an urgent security advisory (FEDORA-2026-7eaf665007) addressing CVE-2026-32249, a high-severity NULL pointer dereference vulnerability in Vim's NFA regex engine. Read more: 👉 https://tinyurl.com/3sd7vdbb #Securtity https://t.co/onNEkLjyir
Post summary
Fedora released an urgent advisory for CVE-2026-32249, a high‑severity NULL pointer dereference in Vim's NFA regex engine, indicating a vendor patch is available.
0000058
1.5K followersView on X
CVE@CVEnew212d
Disclosure
CVE-2026-32249 Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining cha… https://www.cve.org/CVERecord?id=CVE-2026-32249
Post summary
The tweet announces the CVE-2026-32249 vulnerability in Vim’s NFA regex compiler, providing technical details but no PoC, exploit, or mitigation information.
00000122
56.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds212d
Disclosure
CVE-2026-32249 Vim NFA Regex Compiler Segmentation Fault in Versions 9.1.0011 to 9.2.0137 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32249
Post summary
The post announces a segmentation fault vulnerability in Vim's NFA regex compiler affecting specific versions, without providing PoC, exploitation details, or mitigation information.
0000028
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	vim	vim	-	-	-

Explore more

Back to dashboard vim CVEs vim vulnerabilities

What researchers are saying

CVE-2026-32249

Rahisisi@HapankaalimehuPatch

Two Vim vulnerabilities (CVE‑2026‑32249 and CVE‑2026‑33412) permit attackers to supply malicious regex or glob patterns that can lead to arbitrary code execution; Debian and Red Hat have released patches for both.

geoffrey_gordon_ashbrook@GG_AshbrookGeneral

The brief mention only identifies CVE-2026-32249 and provides a link to the NVD entry, lacking further technical detail, patch info, or exploitation context.

Ferramentas Linux@Cezar_H_LinuxDisclosure

Fedora released an urgent advisory for CVE-2026-32249, a high‑severity NULL pointer dereference in Vim's NFA regex engine, indicating a vendor patch is available.

CVE@CVEnewDisclosure

The tweet announces the CVE-2026-32249 vulnerability in Vim’s NFA regex compiler, providing technical details but no PoC, exploit, or mitigation information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces a segmentation fault vulnerability in Vim's NFA regex compiler affecting specific versions, without providing PoC, exploitation details, or mitigation information.