CVE-2026-73070: Vim: Stack Buffer Overflow in the Vim Socket Server
Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept(), causing descriptors to overflow fdset structures in src/channel.c and fixed-size struct pollfd arrays in src/osunix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vimto a version that resolves this vulnerability.Fixed in 9.2.0842
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73070?
CVE-2026-73070 has a risk rating of 34, indicating a significant security vulnerability.
How do I fix CVE-2026-73070?
To fix CVE-2026-73070, upgrade Vim to version 9.2.0842 or later.
What does CVE-2026-73070 affect?
CVE-2026-73070 affects versions of Vim prior to 9.2.0842 that utilize the socket server backend.
What are the implications of CVE-2026-73070?
CVE-2026-73070 can lead to a stack buffer overflow, potentially allowing an attacker to disrupt services or execute arbitrary code.
Is there a workaround for CVE-2026-73070 if I cannot upgrade?
Currently, there are no documented workarounds for CVE-2026-73070, so upgrading is the recommended action.