CVE-2026-57452: Vim: Out-of-bounds Read with libsodium-encrypted Files
Last updated 2 July 2026
Other sources
Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.
— NVD
Vim: Out-of-bounds Read with libsodium-encrypted Files
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0735-1 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0671
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57452?
The severity of CVE-2026-57452 is medium with a score of 5.5.
How do I fix CVE-2026-57452?
To fix CVE-2026-57452, update Vim to version 9.2.0671 or later.
What is the impact of CVE-2026-57452?
CVE-2026-57452 can lead to an out-of-bounds read when opening specific encrypted files, posing potential security risks.
Which versions of Vim are affected by CVE-2026-57452?
Vim versions prior to 9.2.0671 are affected by CVE-2026-57452.
What encrypted file methods are involved in CVE-2026-57452?
CVE-2026-57452 involves files encrypted with the VimCrypt~04! or VimCrypt~05! methods.