Vim Command Line Text Editor Vulnerability in JSON Decoding Process
CVE-2026-73071

3.3LOW

Key Information:

Vendor

Vim

Status
Vim
Vendor
CVE Published:
11 August 2026

What is CVE-2026-73071?

In the Vim text editor, a vulnerability has been identified in the JSON decoding process within the versions from 9.2.0511 to 9.2.0844. Specifically, the function json_decode_item() can retain a stale pointer after the invocation of json_decode_string(), due to the channel_fill() function that refills and frees the current buffer. This flaw can lead to undefined behavior when an invalid JSON string spans multiple buffers, allowing access to freed memory instead of the intended data. This issue has been rectified in version 9.2.0844.

Affected Version(s)

vim >= 9.2.0511, < 9.2.0844

References

https://github.com/vim/vim/security/advisories/GHSA-69ch-...
x_refsource_CONFIRM
https://github.com/vim/vim/commit/f8126294a526aa80c5123eb...
x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0844
x_refsource_MISC

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.