CVE-2026-26269

Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/vim/vim/commit/c5f312aad8e4179e437f81ad39a860cd0ef11970	Patch
https://github.com/vim/vim/releases/tag/v9.1.2148	Release Notes
https://github.com/vim/vim/security/advisories/GHSA-9w5c-hwr9-hc68	Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/02/13/2	Mailing List Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-13 20:17

Updated : 2026-02-18 21:29

NVD link : CVE-2026-26269

Mitre link : CVE-2026-26269

CVE.ORG link : CVE-2026-26269

JSON object : View

Products Affected

vim

vim

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-26269", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2026-02-13T20:17:41.377", "references": [{"url": "https://github.com/vim/vim/commit/c5f312aad8e4179e437f81ad39a860cd0ef11970", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vim/vim/releases/tag/v9.1.2148", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vim/vim/security/advisories/GHSA-9w5c-hwr9-hc68", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "http://www.openwall.com/lists/oss-security/2026/02/13/2", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148."}, {"lang": "es", "value": "Vim es un editor de texto de c\u00f3digo abierto, de l\u00ednea de comandos. Antes de la versi\u00f3n 9.1.2148, existe una vulnerabilidad de desbordamiento de b\u00fafer de pila en la integraci\u00f3n de NetBeans de Vim al procesar el comando specialKeys, afectando a las compilaciones de Vim que habilitan y usan la caracter\u00edstica de NetBeans. El desbordamiento de b\u00fafer de pila existe en special_keys() (en src/netbeans.c). El bucle while (*tok) escribe dos bytes por iteraci\u00f3n en un b\u00fafer de pila de 64 bytes (keybuf) sin verificaci\u00f3n de l\u00edmites. Un servidor NetBeans malicioso puede desbordar keybuf con un solo comando specialKeys. El problema ha sido solucionado a partir del parche de Vim v9.1.2148."}], "lastModified": "2026-02-18T21:29:03.767", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19A1D55B-E01D-4324-B9FA-7FD3C9E65EE6", "versionEndExcluding": "9.1.2148"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}