Heap-Based Buffer Overflow in Vim Command Line Text Editor

CVE-2026-28418

What is CVE-2026-28418?

Vim, an open-source command line text editor, contains a heap-based buffer overflow vulnerability that occurs during the parsing of Emacs-style tags files. This flaw allows an attacker to craft a malformed tags file which can trick Vim into accessing memory beyond the allocated buffer, potentially leading to unintended memory disclosure or application instability. Users are advised to upgrade to version 9.2.0074 or later to mitigate this issue and ensure safe operation.

References