https://seclists.org/oss-sec/2026/q3/596: [vim-security] Integer Overflow in Undo File Entry Size Check in Vim < v9.2.1014 && Vim >= v8.1.0688

Q: Which deployments are affected?

Only 32-bit builds are affected. The issue applies to Vim versions from v8.1.0688 through versions earlier than v9.2.1014.

Q: What does an attacker need to trigger the flaw?

Vim must read a persistent undo file containing an undo entry with an attacker-controlled line count. That count can pass the incorrect size check and cause an undersized allocation followed by an out-of-bounds write.

Q: Is a CVE identifier available for tracking?

No. A CVE has been requested but was not assigned at the time of publication.

Published Aug 26, 2026

Updated

Affected Software

1 affected component

vim Vim>v9.2.1014<=v8.1.0688

Frequently Asked Questions

Which deployments are affected?

Only 32-bit builds are affected. The issue applies to Vim versions from v8.1.0688 through versions earlier than v9.2.1014.

What does an attacker need to trigger the flaw?

Vim must read a persistent undo file containing an undo entry with an attacker-controlled line count. That count can pass the incorrect size check and cause an undersized allocation followed by an out-of-bounds write.

Is a CVE identifier available for tracking?

No. A CVE has been requested but was not assigned at the time of publication.