Command line text editor vulnerability in Vim affects user command execution
CVE-2026-73076

8.4HIGH

Key Information:

Vendor

Vim

Status
Vim
Vendor
CVE Published:
11 August 2026

What is CVE-2026-73076?

Vim, an open-source command line text editor, features a vulnerability that allows a specially crafted vimball member named '.VimballRecord' to overwrite the installation record. This compromise occurs prior to version 9.2.0847. When the function vimball#RmVimball() processes the affected record entry, it can execute stored Ex commands, including system commands initiated through ':!', with the privileges of the user executing Vim. This poses a significant risk as it enables attackers to run unauthorized commands within the context of the user, potentially leading to system compromise.

Affected Version(s)

vim < 9.2.0847

References

https://github.com/vim/vim/security/advisories/GHSA-r22p-...
x_refsource_CONFIRM
https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6...
x_refsource_MISC

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.