Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8500-1 advisory.

    It was discovered that Vim incorrectly handled path traversal in the zip.vim plugin. An attacker could     possibly use this issue to overwrite arbitrary files. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-35177)

    It was discovered that Vim incorrectly handled depth tracking when processing spell files. An attacker     could possibly use this issue to cause a denial of service. (CVE-2026-55693, CVE-2026-55892)

    It was discovered that Vim incorrectly handled filename escaping in the netrw plugin. An attacker could     possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04     LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
    (CVE-2026-55895)

    It was discovered that Vim incorrectly handled length calculations when opening encrypted files. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04     LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-57452)

    Dhruv Vishesh Gupta discovered that Vim incorrectly handled quoting of archive entry names. An attacker     could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS.
    (CVE-2026-57453)

    It was discovered that Vim incorrectly handled bounds checking when translating words through a byte map.
    An attacker could possibly use this issue to cause a denial of service. (CVE-2026-57455)

    Chenyuan Mi discovered that Vim incorrectly handled docstring escaping during Python omni-completion. An     attacker could possibly use this issue to execute arbitrary code. (CVE-2026-57456)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Vim installed on the remote host is prior to 9.2.0671. It is, therefore, affected by a vulnerability.

  - When Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the     +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation     underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim.
    (CVE-2026-57452)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with     the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is     shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a     subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is     fixed in 9.2.0671. (CVE-2026-57452)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c
    reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte
    textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the
    count is never checked against the amount of data actually present. A line that declares a large count
    while carrying little data causes consumers to read far past the end of the line buffer. Such a line can
    be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.
    (CVE-2026-57451)

  - Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with
    the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is
    shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a
    subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is
    fixed in 9.2.0671. (CVE-2026-57452)

ID	Name	Product	Family	Severity
324991	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Vim vulnerabilities (USN-8500-1)	Nessus	Ubuntu Local Security Checks	high
324729	Vim < 9.2.0671 Out-of-Bounds Read (GHSA-c4j9-wr9j-4486)	Nessus	Misc.	medium
323751	Linux Distros Unpatched Vulnerability : CVE-2026-57452	Nessus	Misc.	medium
443970	Alpine: gvim, multiple vim packages, xxd: security update to 9.2.0677-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
443970	Alpine: gvim, multiple vim packages, xxd: security update to 9.2.0677-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium

Detections

Analytics

CVE-2026-57452

medium

Tenable Plugins

high

medium

medium

medium

medium