Threats affecting pkg:github/vim/vim

CVE-2026-51401 is a high-severity vulnerability in Vim Project versions 9.2.0389 and earlier. It allows a local attacker to execute arbitrary code via the vms_fixfilename() function in the source file vim/src/os_vms.c. The vulnerability is related to improper handling of input that leads to code execution without requiring user interaction or privileges. No official patch or remediation details are currently available.

A vulnerability in Vim Project versions 9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function in the source file vim/src/os_vms.c. The issue is identified as CWE-401 and has a high severity with a CVSS score of 8.4. No official patch or remediation information is currently provided.

CVE-2024-41957 is a double free vulnerability in Vim versions prior to 9.1.0647. It occurs in the src/alloc.c file when closing a window, where tagstack data is freed twice if the quickfix list points to the same data. This can lead to a crash of Vim. The vulnerability requires the user to intentionally run Vim with several non-default flags, limiting its impact. The issue is fixed in Vim patch 9.1.0647.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.

Use After Free in GitHub repository vim/vim prior to 9.0.1858.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.

Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.