CVE-2026-28419: Vim has Heap-based Buffer Underflow in Emacs tags parsing
Vim has Heap-based Buffer Underflow in Emacs tags parsing
Other sources
Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.1.1230-2+deb13u1Fixed in 2:9.2.0858-1 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.1.1230-2+deb13u1 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.2.0119-1 - Upgrade
Upgrade
alpine/vimto a version that resolves this vulnerability.Fixed in 9.2.0078-r0 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0075
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28419?
CVE-2026-28419 is classified as a critical severity vulnerability due to its potential for heap-based buffer underflow.
How do I fix CVE-2026-28419?
To fix CVE-2026-28419, upgrade Vim to version 9.2.0075 or later.
What versions of Vim are affected by CVE-2026-28419?
Vim versions prior to 9.2.0075 are affected by CVE-2026-28419.
What is the nature of the vulnerability CVE-2026-28419?
CVE-2026-28419 involves a heap-based buffer underflow triggered by malformed Emacs style tags files.
Can CVE-2026-28419 lead to exploitation?
Yes, CVE-2026-28419 can potentially be exploited, leading to arbitrary code execution.