REDHAT-BUG-2514034: High severity vim Vim vulnerability

Q: What must an attacker provide or convince a user to do to trigger this issue?

An attacker needs to supply a crafted vimball containing a member named .VimballRecord. The attacker-controlled commands execute later when vimball#RmVimball() processes the corresponding installation record entry.

Q: What level of access do the executed commands receive?

Commands stored in the overwritten installation record run with the privileges of the user running Vim. This can include operating-system commands invoked through the Vim :! command.

Q: Which versions are affected and what version fixes the issue?

The issue affects Vim versions prior to 9.2.0847. It is fixed in Vim 9.2.0847.

Published Aug 11, 2026

Updated

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.

Affected Software

1 affected component

vim Vim<9.2.0847

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vim to a version that resolves this vulnerability.
Fixed in 9.2.0847

Event History

Aug 11, 2026

Data Sourced

via Red Hat·03:41 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker provide or convince a user to do to trigger this issue?

An attacker needs to supply a crafted vimball containing a member named .VimballRecord. The attacker-controlled commands execute later when vimball#RmVimball() processes the corresponding installation record entry.

What level of access do the executed commands receive?

Commands stored in the overwritten installation record run with the privileges of the user running Vim. This can include operating-system commands invoked through the Vim :! command.

Which versions are affected and what version fixes the issue?

The issue affects Vim versions prior to 9.2.0847. It is fixed in Vim 9.2.0847.

REDHAT-BUG-2514034: High severity vim Vim vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker provide or convince a user to do to trigger this issue?

What level of access do the executed commands receive?

Which versions are affected and what version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide or convince a user to do to trigger this issue?

What level of access do the executed commands receive?

Which versions are affected and what version fixes the issue?