Skip to content
CVE PROGRAM SOURCE RECORD4.4 Medium

CVE-2026-28418

Vim has Heap-based Buffer Overflow in Emacs tags parsing

Description

Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

vim vim

  • < 9.2.0074affected

References