vim: Fix of 21 CVEs
- CVE-2021-4019: replace the unbounded STRCPY pair in find_help_tags() with vim_snprintf bounded by IOSIZE to prevent heap buffer overflow with long :help arguments starting with "\%_z@". - CVE-2021-4192: re-fetch regline/reginput via reg_getline() after getvvcol() in reg_match_visual() so the cached line pointer cannot become a use-after-free when getvvcol flushes the line buffer. - CVE-2021-4193: clamp pos->col to the first NUL in getvcol() so /\%V searches cannot read past the end of the line. - CVE-2022-1720: in get_visual_text(), drop a trailing NUL from non-mbyte selection length and guard the mbyte correction with *lenp > 0 so "gf" in Visual block mode does not read past the line. - CVE-2022-2126: also require sp->ts_fidx > 0 before decrementing ts_fidx in the DIFF_INSERT branch of suggest_trie_walk() so spell suggestion cannot read before the start of the bad-word buffer. - CVE-2022-2210: initialise off = 0 at the top of the deleted > 0 branch of diff_mark_adjust_tp() and only compute the real offset in the "5. delete lines at or just before top of diff" case, so a diff-block full-delete does not use a stale offset. - CVE-2022-2285: place a NUL terminator at tp[len] before key-name matching in check_termcode() so crafted typeahead cannot be read past the end of the buffer. - CVE-2022-2345: always vim_strsave(newsub) into reg_prev_sub in regtilde() and track an allocated regtilde result in sub_copy in do_sub() so a recursive :s cannot use freed memory.
- Products
- vim-X11, vim-common, vim-enhanced, vim-filesystem, vim-minimal
- Affected versions
- Not specified
- Fixed versions
- 2:7.4.629-8.0.1.el7_9.tuxcare.els7
- CVEs
- CVE-2021-4019, CVE-2021-4192, CVE-2021-4193, CVE-2022-1720, CVE-2022-2126, CVE-2022-2210, CVE-2022-2285, CVE-2022-2345
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:00 UTC · Revision 1
Source evidence
- CVE-2021-4019: replace the unbounded STRCPY pair in find_help_tags() with vim_snprintf bounded by IOSIZE to prevent heap buffer overflow with long :help arguments starting with "\%_z@". - CVE-2021-4192: re-fetch regline/reginput via reg_getline() after getvvcol() in reg_match_visual() so the cached line pointer cannot become a use-after-free when getvvcol flushes the line buffer. - CVE-2021-4193: clamp pos->col to the first NUL in getvcol() so /\%V searches cannot read past the end of the line. - CVE-2022-1720: in get_visual_text(), drop a trailing NUL from non-mbyte selection length and guard the mbyte correction with *lenp > 0 so "gf" in Visual block mode does not read past the line. - CVE-2022-2126: also require sp->ts_fidx > 0 before decrementing ts_fidx in the DIFF_INSERT branch of suggest_trie_walk() so spell suggestion cannot read before the start of the bad-word buffer. - CVE-2022-2210: initialise off = 0 at the top of the deleted > 0 branch of diff_mark_adjust_tp() and only compute the real offset in the "5. delete lines at or just before top of diff" case, so a diff-block full-delete does not use a stale offset. - CVE-2022-2285: place a NUL terminator at tp[len] before key-name matching in check_termcode() so crafted typeahead cannot be read past the end of the buffer. - CVE-2022-2345: always vim_strsave(newsub) into reg_prev_sub in regtilde() and track an allocated regtilde result in sub_copy in do_sub() so a recursive :s cannot use freed memory.
osv:CLSA-2026-1777477742
vim-X11
Fixed versions: 2:7.4.629-8.0.1.el7_9.tuxcare.els7
vim-common
Fixed versions: 2:7.4.629-8.0.1.el7_9.tuxcare.els7
vim-enhanced
Fixed versions: 2:7.4.629-8.0.1.el7_9.tuxcare.els7
vim-filesystem
Fixed versions: 2:7.4.629-8.0.1.el7_9.tuxcare.els7
vim-minimal
Fixed versions: 2:7.4.629-8.0.1.el7_9.tuxcare.els7
Complete source record
{
"id": "28ec26376b695c132479c0a59e2e7fa8b3c50e76ae4068db8ca3f6e830496237",
"url": "https://osv.dev/vulnerability/CLSA-2026-1777477742",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "vim: Fix of 21 CVEs",
"summary": "- CVE-2021-4019: replace the unbounded STRCPY pair in find_help_tags() with vim_snprintf bounded by IOSIZE to prevent heap buffer overflow with long :help arguments starting with \"\\%_z@\". - CVE-2021-4192: re-fetch regline/reginput via reg_getline() after getvvcol() in reg_match_visual() so the cached line pointer cannot become a use-after-free when getvvcol flushes the line buffer. - CVE-2021-4193: clamp pos->col to the first NUL in getvcol() so /\\%V searches cannot read past the end of the line. - CVE-2022-1720: in get_visual_text(), drop a trailing NUL from non-mbyte selection length and guard the mbyte correction with *lenp > 0 so \"gf\" in Visual block mode does not read past the line. - CVE-2022-2126: also require sp->ts_fidx > 0 before decrementing ts_fidx in the DIFF_INSERT branch of suggest_trie_walk() so spell suggestion cannot read before the start of the bad-word buffer. - CVE-2022-2210: initialise off = 0 at the top of the deleted > 0 branch of diff_mark_adjust_tp() and only compute the real offset in the \"5. delete lines at or just before top of diff\" case, so a diff-block full-delete does not use a stale offset. - CVE-2022-2285: place a NUL terminator at tp[len] before key-name matching in check_termcode() so crafted typeahead cannot be read past the end of the buffer. - CVE-2022-2345: always vim_strsave(newsub) into reg_prev_sub in regtilde() and track an allocated regtilde result in sub_copy in do_sub() so a recursive :s cannot use freed memory.",
"evidence": "osv:CLSA-2026-1777477742",
"products": [
{
"name": {
"value": "vim-X11",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:7.4.629-8.0.1.el7_9.tuxcare.els7",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-common",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:7.4.629-8.0.1.el7_9.tuxcare.els7",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-enhanced",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:7.4.629-8.0.1.el7_9.tuxcare.els7",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-filesystem",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:7.4.629-8.0.1.el7_9.tuxcare.els7",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-minimal",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:7.4.629-8.0.1.el7_9.tuxcare.els7",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1777477742",
"aliases": [
"CLSA-2026-1777477742"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:7.4.629-8.0.1.el7_9.tuxcare.els7"
}
]
}
],
"package": {
"name": "vim-X11",
"purl": "pkg:rpm/tuxcare/vim-X11?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1777477742.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:7.4.629-8.0.1.el7_9.tuxcare.els7"
}
]
}
],
"package": {
"name": "vim-common",
"purl": "pkg:rpm/tuxcare/vim-common?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1777477742.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:7.4.629-8.0.1.el7_9.tuxcare.els7"
}
]
}
],
"package": {
"name": "vim-enhanced",
"purl": "pkg:rpm/tuxcare/vim-enhanced?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1777477742.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:7.4.629-8.0.1.el7_9.tuxcare.els7"
}
]
}
],
"package": {
"name": "vim-filesystem",
"purl": "pkg:rpm/tuxcare/vim-filesystem?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1777477742.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:7.4.629-8.0.1.el7_9.tuxcare.els7"
}
]
}
],
"package": {
"name": "vim-minimal",
"purl": "pkg:rpm/tuxcare/vim-minimal?distro=centos-7",
"ecosystem": "TuxCare:CentOS:7"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1777477742.json"
}
}
],
"modified": "2026-10-26T09:31:40.803436260Z",
"provider": "osv",
"upstream": [
"CVE-2021-4019",
"CVE-2021-4192",
"CVE-2021-4193",
"CVE-2022-1720",
"CVE-2022-2126",
"CVE-2022-2210",
"CVE-2022-2285",
"CVE-2022-2345"
],
"references": [
"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1777477742.html",
"https://nvd.nist.gov/vuln/detail/CVE-2021-3872",
"https://nvd.nist.gov/vuln/detail/CVE-2021-3927",
"https://nvd.nist.gov/vuln/detail/CVE-2021-4019",
"https://nvd.nist.gov/vuln/detail/CVE-2021-4166",
"https://nvd.nist.gov/vuln/detail/CVE-2021-4192",
"https://nvd.nist.gov/vuln/detail/CVE-2021-4193",
"https://nvd.nist.gov/vuln/detail/CVE-2022-0359",
"https://nvd.nist.gov/vuln/detail/CVE-2022-1154",
"https://nvd.nist.gov/vuln/detail/CVE-2022-1619",
"https://nvd.nist.gov/vuln/detail/CVE-2022-1720",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2126",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2210",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2284",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2285",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2344",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2345",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2581",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2598",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2845",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2980",
"https://nvd.nist.gov/vuln/detail/CVE-2026-25749"
]
},
"related_cves": [
{
"value": "CVE-2021-4019",
"evidence": "/upstream"
},
{
"value": "CVE-2021-4192",
"evidence": "/upstream"
},
{
"value": "CVE-2021-4193",
"evidence": "/upstream"
},
{
"value": "CVE-2022-1720",
"evidence": "/upstream"
},
{
"value": "CVE-2022-2126",
"evidence": "/upstream"
},
{
"value": "CVE-2022-2210",
"evidence": "/upstream"
},
{
"value": "CVE-2022-2285",
"evidence": "/upstream"
},
{
"value": "CVE-2022-2345",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 448083,
"published_at": "2026-07-23T22:33:59+00:00"
}