CVE-2026-52859: Vim: Out-of-bounds Read in Terminal Screen Snapshot
Last updated 19 June 2026
Other sources
Vim is an open source, command line text editor. Prior to version 9.2.0565, the updatesnapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERMMAXCHARSPERCELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.
— MITRE
Vim: Out-of-bounds Read in Terminal Screen Snapshot
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0620-1 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0565
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52859?
The severity of CVE-2026-52859 is medium with a CVSS score of 6.9.
How do I fix CVE-2026-52859?
To fix CVE-2026-52859, update Vim to version 9.2.0565 or later.
What type of vulnerability is CVE-2026-52859?
CVE-2026-52859 is an out-of-bounds read vulnerability in the Vim text editor.
What software is affected by CVE-2026-52859?
CVE-2026-52859 affects Vim version prior to 9.2.0565.
Can CVE-2026-52859 be exploited remotely?
Yes, CVE-2026-52859 has an attack vector of AV:N, indicating that it can be exploited remotely.