Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-5602 advisory.

    [8.2.2637-23.0.1.el9_7.1]
    - Remove upstream references [Orabug: 31197557]

    [2:8.2.2637-23.1]
    - RHEL-147940 CVE-2026-25749 vim: Heap Overflow in Vim

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0178 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-28422:
    Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs     in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide     terminal. Version 9.2.0078 patches the issue.

    CVE-2026-28421:
    Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow     and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated     fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.

    CVE-2026-28420:
    Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow     WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining     characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.

    CVE-2026-28419:
    Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow     exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a     delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated     buffer. Version 9.2.0075 fixes the issue.

    CVE-2026-28418:
    Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow     out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags     file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074     fixes the issue.

    CVE-2026-28417:
    Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection     vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted     URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the     privileges of the Vim process. Version 9.2.0073 fixes the issue.

    CVE-2026-26269:
    Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability     exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that     enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in     src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf)     with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command.
    The issue has been fixed as of Vim patch v9.1.2148.

    CVE-2026-25749:
    Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow     vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The     vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim     copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes     (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been     patched in version 9.1.2132.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0057 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-25749:
    Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow     vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The     vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim     copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes     (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been     patched in version 9.1.2132.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:5602 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the vim package has been released.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:4715 advisory.

    * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8101-1 advisory.

    Rahul Hoysala discovered that Vim did not correctly handle certain tag resolutions. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-25749)

    It was discovered that Vim did not correctly handle processing certain specialKey commands. An attacker     could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-26269)

    Kim Dong Han discovered that Vim did not correctly handle opening certain URLs. If a user or system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to execute     arbitrary code. (CVE-2026-28417)

    Kim Dong Han discovered that Vim did not correctly handle parsing Emacs-style tag files. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-28418, CVE-2026-28419)

    Kim Dong Han discovered that Vim did not correctly handle processing maximum combining characters from     Unicode supplementary planes. An attacker could possibly use this issue to cause a denial of service or     execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,     Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-28420)

    Kim Dong Han discovered that Vim did not correctly handle swap file recovery. An attacker could possibly     use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-28421)

    Kim Dong Han discovered that Vim did not correctly handle rendering status lines. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-28422)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-4715 advisory.

    [9.1.083-6.0.1.el10_1.1]
    - Remove upstream references [Orabug: 31197557]

    [2:9.1.083-6.1]
    - RHEL-147922 CVE-2026-25749 vim: Heap Overflow in Vim

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4715 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-306:01 advisory.

    * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006139 advisory.

    Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow     vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The     vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim     copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes     (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been     patched in version 9.1.2132.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:4442 advisory.

    * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:4442 advisory.

    * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-4442 advisory.

    [8.0.1763-22.0.1]
    - Remove upstream references [Orabug: 31197557]
    - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984]

    [2:8.0.1763-22]
    - RHEL-147935 CVE-2026-25749 vim: Heap Overflow in Vim

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4442 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7eda235f65 advisory.

    patchlevel 2146

    Security fix for CVE-2026-25749

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the vim-8.2.2637-25.el9 build changelog.

  - Heap Overflow in Vim (CVE-2026-25749)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f4563b100f advisory.

    patchlevel 2146

    Security fix for CVE-2026-25749

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Vim installed on the remote host is prior to 9.1.2132. It is, therefore, affected by a vulnerability as referenced in the GHSA-5w93-4g67-mm43 advisory.

  - Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow     vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The     vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags,     Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1     bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue     has been patched in version 9.1.2132. (CVE-2026-25749)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow     vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The     vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim     copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes     (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been     patched in version 9.1.2132. (CVE-2026-25749)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303498	Oracle Linux 9 : vim (ELSA-2026-5602)	Nessus	Oracle Linux Local Security Checks	medium
303491	TencentOS Server 4: vim (TSSA-2026:0178)	Nessus	Tencent Local Security Checks	high
303436	Alibaba Cloud Linux 3 : 0057: vim (ALINUX3-SA-2026:0057)	Nessus	Alibaba Cloud Linux Local Security Checks	medium
303420	RHEL 9 : vim (RHSA-2026:5602)	Nessus	Red Hat Local Security Checks	medium
303400	Photon OS 4.0: Vim PHSA-2026-4.0-0979	Nessus	PhotonOS Local Security Checks	high
303214	AlmaLinux 10 : vim (ALSA-2026:4715)	Nessus	Alma Linux Local Security Checks	medium
303027	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Vim vulnerabilities (USN-8101-1)	Nessus	Ubuntu Local Security Checks	high
302810	Oracle Linux 10 : vim (ELSA-2026-4715)	Nessus	Oracle Linux Local Security Checks	medium
302787	RHEL 10 : vim (RHSA-2026:4715)	Nessus	Red Hat Local Security Checks	medium
302752	Photon OS 5.0: Vim PHSA-2026-5.0-0785	Nessus	PhotonOS Local Security Checks	high
302486	MiracleLinux 8 : vim-8.0.1763-22.el8_10 (AXSA:2026-306:01)	Nessus	Miracle Linux Local Security Checks	medium
302311	Unity Linux 20.1070e Security Update: vim (UTSA-2026-006139)	Nessus	Unity Linux Local Security Checks	medium
302187	AlmaLinux 8 : vim (ALSA-2026:4442)	Nessus	Alma Linux Local Security Checks	medium
302143	RockyLinux 8 : vim (RLSA-2026:4442)	Nessus	Rocky Linux Local Security Checks	medium
302119	Oracle Linux 8 : vim (ELSA-2026-4442)	Nessus	Oracle Linux Local Security Checks	medium
301940	RHEL 8 : vim (RHSA-2026:4442)	Nessus	Red Hat Local Security Checks	medium
299372	Fedora 43 : vim (2026-7eda235f65)	Nessus	Fedora Local Security Checks	medium
299201	CentOS 9 : vim-8.2.2637-25.el9	Nessus	CentOS Local Security Checks	medium
299147	Fedora 42 : vim (2026-f4563b100f)	Nessus	Fedora Local Security Checks	medium
298656	Vim < 9.1.2132 Buffer Overflow (GHSA-5w93-4g67-mm43)	Nessus	Misc.	medium
298305	Linux Distros Unpatched Vulnerability : CVE-2026-25749	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-25749

medium

Tenable Plugins

medium

high

medium

medium

high

medium

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium