CVE-2026-73076: Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0847
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73076?
CVE-2026-73076 has a risk score of 55, indicating a moderate level of concern.
How do I fix CVE-2026-73076?
To fix CVE-2026-73076, you should update Vim to version 9.2.0847 or later.
What type of vulnerability is CVE-2026-73076?
CVE-2026-73076 is categorized as a code injection vulnerability.
Who is affected by CVE-2026-73076?
CVE-2026-73076 affects users of Vim versions prior to 9.2.0847.
What can an attacker do with CVE-2026-73076?
An attacker can execute arbitrary commands by exploiting a crafted .VimballRecord entry.