CVE-2026-28420: Vim has Heap-based Buffer Overflow and OOB Read in :terminal
Vim has Heap-based Buffer Overflow and OOB Read in :terminal
Other sources
Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0076
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28420?
CVE-2026-28420 has been classified as a high severity vulnerability due to its potential to cause heap-based buffer overflow and out-of-bounds read.
How do I fix CVE-2026-28420?
To fix CVE-2026-28420, upgrade Vim to version 9.2.0076 or later.
What are the potential impacts of CVE-2026-28420?
The impacts of CVE-2026-28420 may include application crashes, data corruption, and the potential for arbitrary code execution.
Which versions of Vim are affected by CVE-2026-28420?
CVE-2026-28420 affects all versions of Vim prior to 9.2.0076.
Is there a workaround for CVE-2026-28420 if I cannot update Vim?
There are no known workarounds for CVE-2026-28420; the best mitigation is to update to a patched version.