{"id":"AZL-91098","summary":"CVE-2026-57452 affecting package vim for versions less than 9.2.0735-1","details":"Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05!\nmethod (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.","modified":"2026-08-28T17:48:11.885837377Z","published":"2026-06-25T16:16:42Z","upstream":["CVE-2026-57452"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57452"}],"affected":[{"package":{"name":"vim","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/vim"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0735-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91098.json"}}],"schema_version":"1.9.0"}