Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

An update of the vim package has been released.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-11389 advisory.

    - RHEL-159615 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function
    - RHEL-155409 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file
    - RHEL-155425 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw     plugin

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-11510 advisory.

    - RHEL-155437 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw     plugin
    - RHEL-155422 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file
    - RHEL-159629 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:11389 advisory.

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:11509 advisory.

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3251 advisory.

    A modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file.
    The complete, guitabtooltip and printheader options are missing the P_MLE flag, allowing a modeline to be     executed. Additionally, the mapset() function lacks a check_secure() call, allowing it to be abused from     sandboxed expressions.

    An attacker who can deliver a crafted file to a victim achieves arbitrary command execution with the     privileges of the user running Vim. (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:11509 advisory.

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:11510 advisory.

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-517:10 advisory.

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-514:09 advisory.

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-11509 advisory.

    - RHEL-159620 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function
    - RHEL-155428 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw     plugin

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:11389 advisory.

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:11510 advisory.

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:11510 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:11509 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:11389 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-251d74645b advisory.

    patchlevel 280

    ----

    Security fix for CVE-2026-34714, CVE-2026-35177, CVE-2026-34982


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1607-1 advisory.

    Update to version 9.2.0280.

    - CVE-2026-34982: missing input validation allows for a modeline sandbox bypass and can lead to arbitrary     OS command       execution (bsc#1261271).
    - CVE-2026-34714: missing checks allow for a `tabpanel` modeline escape and can lead to arbitrary OS     command execution       (bsc#1261191).
    - CVE-2026-33412: improper escaping of newline characters allows for command injection in `glob` and can     lead to       arbitrary code execution (bsc#1259985).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014266 advisory.

    Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in     Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`,     `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be     executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused     from sandboxed expressions. Commit 9.2.0276 fixes the issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1387-1 advisory.

    Update to version 9.2.0280.

    - CVE-2026-34982: missing input validation allows for a modeline sandbox bypass and can lead to arbitrary     OS command       execution (bsc#1261271).
    - CVE-2026-34714: missing checks allow for a `tabpanel` modeline escape and can lead to arbitrary OS     command execution       (bsc#1261191).
    - CVE-2026-33412: improper escaping of newline characters allows for command injection in `glob` and can     lead to       arbitrary code execution (bsc#1259985).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1347-1 advisory.

    Update to version 9.2.0280.

    - CVE-2026-34982: missing input validation allows for a modeline sandbox bypass and can lead to arbitrary     OS command       execution (bsc#1261271).
    - CVE-2026-34714: missing checks allow for a `tabpanel` modeline escape and can lead to arbitrary OS     command execution       (bsc#1261191).
    - CVE-2026-33412: improper escaping of newline characters allows for command injection in `glob` and can     lead to       arbitrary code execution (bsc#1259985).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8171-1 advisory.

    Nathan Mills discovered that Vim could crash when parsing certain regular expressions. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu     25.10 (CVE-2026-32249)

    It was discovered that Vim did not properly sanitize user input. An attacker could possibly use this issue     to execute arbitrary commands. (CVE-2026-33412)

    Avishay Matayev discovered that Vim's modeline sandbox could be bypassed when opening a maliciously-     crafted file. An attacker could possibly use this issue to execute arbitrary commands. This issue only     affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1584 advisory.

    When switching to other buffers using the :all command and visual mode still being active, this may cause     a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access     beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before     opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try     to access a position if the position is greater than the corresponding buffer line. Impact is medium since     the user must have switched on visual mode when executing the :all ex command. The Vim project would like     to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch     v9.1.1003 (CVE-2025-22134)

    A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of     the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be     performed locally. The exploit is publicly available and might be used. Some users are not able to     reproduce this. One of the users mentions that this appears not to be working, when coloring is turned     on. (CVE-2025-9389)

    A security flaw has been discovered in vim up to 9.1.1615. Affected by this vulnerability is the function     main of the file src/xxd/xxd.c of the component xxd. The manipulation results in buffer overflow. The     attack requires a local approach. The exploit has been released to the public and may be exploited.
    Upgrading to version 9.1.1616 addresses this issue. The patch is identified as     eeef7c77436a78cd27047b0f5fa6925d56de3cb0. It is recommended to upgrade the affected component.
    (CVE-2025-9390)

    Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow     vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The     vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim     copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes     (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been     patched in version 9.1.2132. (CVE-2026-25749)

    Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability     exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that     enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in     src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf)     with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command.
    The issue has been fixed as of Vim patch v9.1.2148. (CVE-2026-26269)

    Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection     vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted     URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the     privileges of the Vim process. Version 9.2.0073 fixes the issue. (CVE-2026-28417)

    Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow     out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags     file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074     fixes the issue. (CVE-2026-28418)

    Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow     exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a     delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated     buffer. Version 9.2.0075 fixes the issue. (CVE-2026-28419)

    Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow     WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining     characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue. (CVE-2026-28420)

    Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex     compiler, when encountering a collection containing a combining character as the endpoint of a character     range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states.
    This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When     nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind     assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This     vulnerability is fixed in 9.2.0137. (CVE-2026-32249)

    Command injection via newline in glob()

    NOTE: https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c (CVE-2026-33412)

    Vim before 9.2.0272 allows code execution that happens immediately upo ...

    NOTE: https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvhNOTE: Fixed by:
    https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459 (v9.2.0272) (CVE-2026-34714)

    A modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file.
    The complete, guitabtooltip and printheader options are missing the P_MLE flag, allowing a modeline to be     executed. Additionally, the mapset() function lacks a check_secure() call, allowing it to be abused from     sandboxed expressions.

    An attacker who can deliver a crafted file to a victim achieves arbitrary command execution with the     privileges of the user running Vim. (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c718defeb6 advisory.

    Security fix for CVE-2026-34714, CVE-2026-35177, CVE-2026-34982



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Vim installed on the remote host is prior to 9.2.0276. It is, therefore, affected by a vulnerability as referenced in the GHSA-8h6p-m6gr-mpw9 advisory.

  - A modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens     a crafted file. The complete, guitabtooltip and printheader options are missing the P_MLE     flag, allowing a modeline to be executed. Additionally, the mapset() function lacks     a check_secure() call, allowing it to be abused from sandboxed expressions. (CVE-2026-34982)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in     Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`,     `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be     executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused     from sandboxed expressions. Commit 9.2.0276 fixes the issue. (CVE-2026-34982)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
313509	Photon OS 4.0: Vim PHSA-2026-4.0-1012	Nessus	PhotonOS Local Security Checks	high
311848	Oracle Linux 10 : vim (ELSA-2026-11389)	Nessus	Oracle Linux Local Security Checks	high
311847	Oracle Linux 9 : vim (ELSA-2026-11510)	Nessus	Oracle Linux Local Security Checks	high
311483	RockyLinux 10 : vim (RLSA-2026:11389)	Nessus	Rocky Linux Local Security Checks	high
311279	RockyLinux 8 : vim (RLSA-2026:11509)	Nessus	Rocky Linux Local Security Checks	high
311207	Amazon Linux 2 : vim, --advisory ALAS2-2026-3251 (ALAS-2026-3251)	Nessus	Amazon Linux Local Security Checks	high
311192	AlmaLinux 8 : vim (ALSA-2026:11509)	Nessus	Alma Linux Local Security Checks	high
311178	RockyLinux 9 : vim (RLSA-2026:11510)	Nessus	Rocky Linux Local Security Checks	high
311176	MiracleLinux 8 : vim-8.0.1763-22.el8_10.3.ML.1 (AXSA:2026-517:10)	Nessus	Miracle Linux Local Security Checks	high
311154	MiracleLinux 9 : vim-8.2.2637-23.el9_7.3.ML.1 (AXSA:2026-514:09)	Nessus	Miracle Linux Local Security Checks	high
311147	Oracle Linux 8 : vim (ELSA-2026-11509)	Nessus	Oracle Linux Local Security Checks	high
311088	AlmaLinux 10 : vim (ALSA-2026:11389)	Nessus	Alma Linux Local Security Checks	high
311086	AlmaLinux 9 : vim (ALSA-2026:11510)	Nessus	Alma Linux Local Security Checks	high
310981	RHEL 9 : vim (RHSA-2026:11510)	Nessus	Red Hat Local Security Checks	high
310974	RHEL 8 : vim (RHSA-2026:11509)	Nessus	Red Hat Local Security Checks	high
310789	RHEL 10 : vim (RHSA-2026:11389)	Nessus	Red Hat Local Security Checks	high
310706	Photon OS 5.0: Vim PHSA-2026-5.0-0830	Nessus	PhotonOS Local Security Checks	high
310691	Fedora 44 : vim (2026-251d74645b)	Nessus	Fedora Local Security Checks	high
310232	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : vim (SUSE-SU-2026:1607-1)	Nessus	SuSE Local Security Checks	high
310010	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2026-014266)	Nessus	Unity Linux Local Security Checks	high
306866	SUSE SLES15 Security Update : vim (SUSE-SU-2026:1387-1)	Nessus	SuSE Local Security Checks	high
306706	SUSE SLES12 Security Update : vim (SUSE-SU-2026:1347-1)	Nessus	SuSE Local Security Checks	high
306258	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Vim vulnerabilities (USN-8171-1)	Nessus	Ubuntu Local Security Checks	high
306195	Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-1584)	Nessus	Amazon Linux Local Security Checks	medium
306076	Fedora 42 : vim (2026-c718defeb6)	Nessus	Fedora Local Security Checks	high
304807	Vim < 9.2.0276 OS Command Injection (GHSA-8h6p-m6gr-mpw9)	Nessus	Misc.	high
304512	Linux Distros Unpatched Vulnerability : CVE-2026-34982	Nessus	Misc.	high

Detections

Analytics

CVE-2026-34982

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high