Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

An update of the vim package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c     reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte     textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the     count is never checked against the amount of data actually present. A line that declares a large count     while carrying little data causes consumers to read far past the end of the line buffer. Such a line can     be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.
    (CVE-2026-57451)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c
    reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte
    textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the
    count is never checked against the amount of data actually present. A line that declares a large count
    while carrying little data causes consumers to read far past the end of the line buffer. Such a line can
    be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.
    (CVE-2026-57451)

  - Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with
    the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is
    shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a
    subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is
    fixed in 9.2.0671. (CVE-2026-57452)

ID	Name	Product	Family	Severity
325971	Photon OS 4.0: Vim PHSA-2026-4.0-1049	Nessus	PhotonOS Local Security Checks	high
323929	Photon OS 5.0: Vim PHSA-2026-5.0-0908	Nessus	PhotonOS Local Security Checks	high
323773	Linux Distros Unpatched Vulnerability : CVE-2026-57451	Nessus	Misc.	medium
443970	Alpine: gvim, multiple vim packages, xxd: security update to 9.2.0677-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
443970	Alpine: gvim, multiple vim packages, xxd: security update to 9.2.0677-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium

Detections

Analytics

CVE-2026-57451

medium

Tenable Plugins

high

high

medium

medium

medium