Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.

An update of the vim package has been released.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0243 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-55693:
    Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in     src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a     depth counter. The counter is bounded only by the trie structure itself; it is never checked against the     size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted     .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily     deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that     corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.

    CVE-2026-57455:
    Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of     spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte     map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and     terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer     the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell     suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer.
    This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This     vulnerability is fixed in 9.2.0698.

    CVE-2026-57456:
    Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion     (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function     and class definitions from the current buffer with exec() as part of populating the completion dictionary.
    When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no     escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled     Python during omni-completion. This vulnerability is fixed in 9.2.0699.

    CVE-2026-59858:
    Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in     runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry,     without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as     a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command;
    opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion     runs that command as the editing user. This issue is fixed in version 9.2.0735.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the vim-8.2.2637-40.el9 build changelog.

  - netrw code injection via NetrwBookHistSave() (CVE-2026-47162)

  - possible code execution with python3complete (CVE-2026-52858)

  - out-of-bounds write in tree_count_words() (CVE-2026-55693)

  - Out-of-bounds write with soundfold() (CVE-2026-57455)

  - possible code execution with python complete (CVE-2026-57456)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1446:20 advisory.

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
      * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
      * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
      * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:48650 advisory.

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
      * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
      * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
      * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)
      * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:48650 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

    * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

    * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

    * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)

    * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:48703 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

    * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

    * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

    * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48703 advisory.

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

    * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

    * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

    * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48650 advisory.

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

    * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

    * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

    * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)

    * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:47982 advisory.

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
      * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
      * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
      * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)
      * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-48703 advisory.

    - RHEL-203873 CVE-2026-59858 vim: arbitrary Ex command execution in       C omni-completion
    - RHEL-194055 CVE-2026-55693 vim: out-of-bounds write in       tree_count_words()
    - RHEL-191365 CVE-2026-57455 vim: Out-of-bounds write with soundfold()

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47982 advisory.

    - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution       in C omni-completion
    - RHEL-201197 CVE-2026-59856 vim: potential command execution in       PHP omni-completion
    - RHEL-191367 CVE-2026-57455 vim: Out-of-bounds write with soundfold()
    - RHEL-192113 CVE-2026-57456 vim: possible code execution with       python complete via crafted docstrings
    - RHEL-194062 CVE-2026-55693 vim: out-of-bounds write in       tree_count_words() and sug_filltree()
    - RHEL-186659 CVE-2026-47162 vim: code injection via       NetrwBookHistSave()
    - RHEL-186646 CVE-2026-52858 vim: possible code execution with       python3complete
    - RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin
    - RHEL-178243 CVE-2026-46483 vim: command injection in tar plugin
    - CVE-2026-41411 vim: Command injection via backticks in tag files

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-48650 advisory.

    - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP       omni-completion
    - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution       during C omni-completion
    - RHEL-194059 CVE-2026-55693 vim: out-of-bounds write in tree_count_words()
    - RHEL-191359 CVE-2026-57455 vim: Out-of-bounds write with soundfold()
    - RHEL-192105 CVE-2026-57456 vim: possible code execution with python complete
    - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave()
    - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete
    - RHEL-185867 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin
    - RHEL-178233 CVE-2026-46483 vim: command injection in tar plugin

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47982 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

    * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

    * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

    * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)

    * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47982 advisory.

    * vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)

    * vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)

    * vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)

    * vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion (CVE-2026-59856)

    * vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0674 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-55693:
    Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in     src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a     depth counter. The counter is bounded only by the trie structure itself; it is never checked against the     size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted     .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily     deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that     corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3804 advisory.

    Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in     src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a     depth counter. The counter is bounded only by the trie structure itself; it is never checked against the     size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted     .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily     deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that     corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653. (CVE-2026-55693)

    Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection     vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin     (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename     derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute     with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate     the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!.
    This vulnerability is fixed in 9.2.0663. (CVE-2026-55895)

    Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion     (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function     and class definitions from the current buffer with exec() as part of populating the completion dictionary.
    When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no     escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled     Python during omni-completion. This vulnerability is fixed in 9.2.0699. (CVE-2026-57456)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1940 advisory.

    Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in     src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a     depth counter. The counter is bounded only by the trie structure itself; it is never checked against the     size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted     .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily     deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that     corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653. (CVE-2026-55693)

    Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in     src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes     that apply to a word. The counter is bounded only by the trie structure itself; it is never checked     against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A     crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so     the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the     call frame and crashes the editor. This vulnerability is fixed in 9.2.0662. (CVE-2026-55892)

    Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection     vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin     (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename     derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute     with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate     the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!.
    This vulnerability is fixed in 9.2.0663. (CVE-2026-55895)

    Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c     reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte     textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the     count is never checked against the amount of data actually present. A line that declares a large count     while carrying little data causes consumers to read far past the end of the line buffer. Such a line can     be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.
    (CVE-2026-57451)

    Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin     autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip     archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the     shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause     PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by     opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678. (CVE-2026-57453)

    Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file     can store a virtual-text property whose offset and length point outside the line's property data. When Vim     restores or displays such a line it converts the offset into a pointer and reads the virtual text without     bounds checking, causing an out-of-bounds read that can crash Vim or disclose adjacent heap memory. This     vulnerability is fixed in 9.2.0679. (CVE-2026-57454)

    Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of     spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte     map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and     terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer     the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell     suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer.
    This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This     vulnerability is fixed in 9.2.0698. (CVE-2026-57455)

    Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion     (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function     and class definitions from the current buffer with exec() as part of populating the completion dictionary.
    When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no     escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled     Python during omni-completion. This vulnerability is fixed in 9.2.0699. (CVE-2026-57456)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8500-1 advisory.

    It was discovered that Vim incorrectly handled path traversal in the zip.vim plugin. An attacker could     possibly use this issue to overwrite arbitrary files. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-35177)

    It was discovered that Vim incorrectly handled depth tracking when processing spell files. An attacker     could possibly use this issue to cause a denial of service. (CVE-2026-55693, CVE-2026-55892)

    It was discovered that Vim incorrectly handled filename escaping in the netrw plugin. An attacker could     possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04     LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
    (CVE-2026-55895)

    It was discovered that Vim incorrectly handled length calculations when opening encrypted files. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04     LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-57452)

    Dhruv Vishesh Gupta discovered that Vim incorrectly handled quoting of archive entry names. An attacker     could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS.
    (CVE-2026-57453)

    It was discovered that Vim incorrectly handled bounds checking when translating words through a byte map.
    An attacker could possibly use this issue to cause a denial of service. (CVE-2026-57455)

    Chenyuan Mi discovered that Vim incorrectly handled docstring escaping during Python omni-completion. An     attacker could possibly use this issue to execute arbitrary code. (CVE-2026-57456)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Vim installed on the remote host is prior to 9.2.0653. It is, therefore, affected by a vulnerability.

  - The tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by     walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never     checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A     crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily     deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the     call frame and crashes the editor. (CVE-2026-55693)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in     src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a     depth counter. The counter is bounded only by the trie structure itself; it is never checked against the     size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted     .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily     deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that     corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653. (CVE-2026-55693)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
334088	Photon OS 5.0: Vim PHSA-2026-5.0-91-0908	Nessus	PhotonOS Local Security Checks	high
333572	Alibaba Cloud Linux 3 : 0243: vim (ALINUX3-SA-2026:0243)	Nessus	Alibaba Cloud Linux Local Security Checks	high
331918	CentOS 9 : vim-8.2.2637-40.el9	Nessus	CentOS Local Security Checks	high
331905	MiracleLinux 8 : vim-8.0.1763-31.el8_10.ML.1 (AXSA:2026-1446:20)	Nessus	Miracle Linux Local Security Checks	high
331725	AlmaLinux 10 : vim (ALSA-2026:48650)	Nessus	Alma Linux Local Security Checks	high
331509	RHEL 10 : vim (RHSA-2026:48650)	Nessus	Red Hat Local Security Checks	high
331502	RHEL 8 : vim (RHSA-2026:48703)	Nessus	Red Hat Local Security Checks	high
331486	RockyLinux 8 : vim (RLSA-2026:48703)	Nessus	Rocky Linux Local Security Checks	high
331484	RockyLinux 10 : vim (RLSA-2026:48650)	Nessus	Rocky Linux Local Security Checks	high
331476	AlmaLinux 9 : vim (ALSA-2026:47982)	Nessus	Alma Linux Local Security Checks	high
331363	Oracle Linux 8 : vim (ELSA-2026-48703)	Nessus	Oracle Linux Local Security Checks	high
331326	Oracle Linux 9 : vim (ELSA-2026-47982)	Nessus	Oracle Linux Local Security Checks	high
331298	Oracle Linux 10 : vim (ELSA-2026-48650)	Nessus	Oracle Linux Local Security Checks	high
330849	RHEL 9 : vim (RHSA-2026:47982)	Nessus	Red Hat Local Security Checks	high
330839	RockyLinux 9 : vim (RLSA-2026:47982)	Nessus	Rocky Linux Local Security Checks	high
330790	TencentOS Server 4: vim (TSSA-2026:0674)	Nessus	Tencent Local Security Checks	high
328825	Amazon Linux 2 : vim, --advisory ALAS2-2026-3804 (ALAS-2026-3804)	Nessus	Amazon Linux Local Security Checks	high
328511	Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-1940)	Nessus	Amazon Linux Local Security Checks	high
325971	Photon OS 4.0: Vim PHSA-2026-4.0-1049	Nessus	PhotonOS Local Security Checks	high
324991	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Vim vulnerabilities (USN-8500-1)	Nessus	Ubuntu Local Security Checks	high
324731	Vim < 9.2.0653 Stack Out-of-Bounds Write (GHSA-wgh4-64f7-q3jq)	Nessus	Misc.	high
323929	Photon OS 5.0: Vim PHSA-2026-5.0-0908	Nessus	PhotonOS Local Security Checks	high
323787	Linux Distros Unpatched Vulnerability : CVE-2026-55693	Nessus	Misc.	high

Detections

Analytics

CVE-2026-55693

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high