{"id":"OESA-2026-2862","summary":"vim security update","details":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.(CVE-2026-55693)\n\nVim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.(CVE-2026-55892)\n\nVim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!.  This vulnerability is fixed in 9.2.0663.(CVE-2026-55895)","modified":"2026-07-06T06:45:19.561743482Z","published":"2026-07-06T06:29:00Z","upstream":["CVE-2026-55693","CVE-2026-55892","CVE-2026-55895"],"database_specific":{"severity":"High"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2862"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55693"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55892"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55895"}],"affected":[{"package":{"name":"vim","ecosystem":"openEuler:22.03-LTS-SP4","purl":"pkg:rpm/openEuler/vim&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-51.oe2203sp4"}]}],"ecosystem_specific":{"x86_64":["vim-X11-9.0-51.oe2203sp4.x86_64.rpm","vim-common-9.0-51.oe2203sp4.x86_64.rpm","vim-debuginfo-9.0-51.oe2203sp4.x86_64.rpm","vim-debugsource-9.0-51.oe2203sp4.x86_64.rpm","vim-enhanced-9.0-51.oe2203sp4.x86_64.rpm","vim-minimal-9.0-51.oe2203sp4.x86_64.rpm"],"aarch64":["vim-X11-9.0-51.oe2203sp4.aarch64.rpm","vim-common-9.0-51.oe2203sp4.aarch64.rpm","vim-debuginfo-9.0-51.oe2203sp4.aarch64.rpm","vim-debugsource-9.0-51.oe2203sp4.aarch64.rpm","vim-enhanced-9.0-51.oe2203sp4.aarch64.rpm","vim-minimal-9.0-51.oe2203sp4.aarch64.rpm"],"noarch":["vim-filesystem-9.0-51.oe2203sp4.noarch.rpm"],"src":["vim-9.0-51.oe2203sp4.src.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-2862.json"}}],"schema_version":"1.7.5"}