Vim Socket Server Vulnerability in Open Source Text Editor

CVE-2026-73070

What is CVE-2026-73070?

The Vim text editor, known for its command-line interface, contains a vulnerability related to its socket server functionality. Prior to version 9.2.0842, the socket server backend did not impose limits on client connections in the socketserver_accept() function. This oversight allows an excessive number of client connections, which can overflow the fd_set structures and the fixed-size struct pollfd arrays utilized by the editor. Such a scenario could enable a local attacker with access to the server socket to corrupt stack memory or to unexpectedly terminate the Vim server, potentially disrupting service or leading to unauthorized access to sensitive data. Users are advised to upgrade to version 9.2.0842 or later to mitigate this risk.

References