Security update for vim
This update for vim fixes the following issues: Updated to version 9.2.0957. Security issues fixed: - CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018). - CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017). - CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016). - CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015). - CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014). - CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013). - CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012). - CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011). Other updates and bugfixes: - Version 9.2.0957. * tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781). * tests: missing cleanup in test_mksession.vim (9.2.0782). * tests: personal spell files leak into later tests (9.2.0783). * crash when borrowing statusline highlight in silent Ex mode (9.2.0784). * WinResized not triggered when the whole Vim is resized (9.2.0785). * filetype: containerfile is not recognized (9.2.0786). * regexp: code 0x1ecb duplicated for equivalence class (9.2.0787). * filetype: hip files are not re
SUSE-SU-2026:23552-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:SUSE-SU-2026:23552-1
vim
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 9.2.0957-160000.1.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
vim
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 9.2.0957-160000.1.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.2.0957-160000.1.1"
}
]
}
],
"package": {
"name": "vim",
"purl": "pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23552-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"vim": "9.2.0957-160000.1.1",
"xxd": "9.2.0957-160000.1.1",
"gvim": "9.2.0957-160000.1.1",
"vim-data": "9.2.0957-160000.1.1",
"vim-small": "9.2.0957-160000.1.1",
"vim-data-common": "9.2.0957-160000.1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.2.0957-160000.1.1"
}
]
}
],
"package": {
"name": "vim",
"purl": "pkg:rpm/suse/vim&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23552-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"vim": "9.2.0957-160000.1.1",
"xxd": "9.2.0957-160000.1.1",
"gvim": "9.2.0957-160000.1.1",
"vim-data": "9.2.0957-160000.1.1",
"vim-small": "9.2.0957-160000.1.1",
"vim-data-common": "9.2.0957-160000.1.1"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #30769 · Revision 1
- Added to Heist Feed
- Publisher date