CVE-2026-73071: Vim: Use-after-free in JSON Decoding
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, jsondecodeitem() in src/json.c can retain a stale pointer after jsondecodestring() invokes channelfill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->jsbuf + reader->jsused when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0957-1 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0844
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73071?
The severity of CVE-2026-73071 is classified as low with a score of 3.3.
What type of vulnerability is CVE-2026-73071?
CVE-2026-73071 is a use-after-free vulnerability occurring in the JSON decoding functionality of Vim.
Which versions of Vim are affected by CVE-2026-73071?
CVE-2026-73071 affects Vim versions from 9.2.0511 until 9.2.0844.
How do I fix CVE-2026-73071?
To fix CVE-2026-73071, users should update their Vim to version 9.2.0845 or later.
What is the impact of CVE-2026-73071?
The impact of CVE-2026-73071 includes potential reading of freed memory, which can lead to application crashes or unexpected behavior.