REDHAT-BUG-2517950: High severity vim Vim vulnerability

Q: What must an attacker control for this issue to be exploitable?

The attacker needs to supply or modify a tags file containing a malicious typeref: or typename: value. Exploitation occurs when Vim resolves a member-access type from that tags file during C omni-completion.

Q: What user action triggers the vulnerable code path?

A user must invoke C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from the affected tags file. The crafted value can then cause arbitrary Ex commands and operating-system commands to execute.

Q: Which Vim versions are affected?

Versions prior to 9.2.0845 are affected. The issue is fixed in Vim 9.2.0845.

Published Aug 18, 2026

Updated

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.

Affected Software

1 affected component

vim Vim<9.2.0845

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vim to a version that resolves this vulnerability.
Fixed in 9.2.0845

Event History

Aug 18, 2026

Data Sourced

via Red Hat·03:41 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker control for this issue to be exploitable?

The attacker needs to supply or modify a tags file containing a malicious typeref: or typename: value. Exploitation occurs when Vim resolves a member-access type from that tags file during C omni-completion.

What user action triggers the vulnerable code path?

A user must invoke C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from the affected tags file. The crafted value can then cause arbitrary Ex commands and operating-system commands to execute.

Which Vim versions are affected?

Versions prior to 9.2.0845 are affected. The issue is fixed in Vim 9.2.0845.

REDHAT-BUG-2517950: High severity vim Vim vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker control for this issue to be exploitable?

What user action triggers the vulnerable code path?

Which Vim versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control for this issue to be exploitable?

What user action triggers the vulnerable code path?

Which Vim versions are affected?