Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3271-1 advisory.

    This update for vim fixes the following issues

    - Updated to version 9.2.0780.
    - CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
    - CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
    - CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3237-1 advisory.

    This update for vim fixes the following issues

    - Updated to version 9.2.0780.
    - CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion (bsc#1271194).
    - CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding (bsc#1271195).
    - CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion (bsc#1271193).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Vim installed on the remote host is prior to 9.2.0725. It is, therefore, affected by a vulnerability as referenced in the GHSA-m3hf-xcm3-xhm2 advisory.

  - Vim's single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL     sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN,     allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element     stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a     SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack     frame and crash the editor. (CVE-2026-59857)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21374-1 advisory.

    Update to version 9.2.0780.

    Security issues fixed:

    - CVE-2026-59856: arbitrary code execution via PHP omni-completion due to improper escaping (bsc#1271194).
    - CVE-2026-59857: out-of-bounds write in SAL soundfolding due to improper bounds check (bsc#1271195).
    - CVE-2026-59858: arbitrary code execution via C omni-completion due to improper escaping (bsc#1271193).

    Other updates and bugfixes:

    - Version 9.2.0780 changelog:
      * filetype detect missing from completion (9.2.0726).
      * popup images not rendered correctly when unfocused (9.2.0727).
      * filetype: supertux info pattern is relative to current dir         (9.2.0728).
      * % skips parens on continued quoted lines (9.2.0729).
      * GTK4 GUI tabline is not updated (9.2.0730).
      * GTK4 GUI scrollbar size not updated when restoring a session         (9.2.0731).
      * session: terminal restored using absolute columns/rows (9.2.0732).
      * GTK3: GUI slow on X11 since dropping the alpha channel (9.2.0733).
      * function pointer passed to STRNCMP() instead of a length         (9.2.0734).
      * tests: comment test can be improved (9.2.0737).
      * completion: 'autocompletedelay' blocks the main loop and drops         autocommands (9.2.0739).
      * GTK4: scrollbar wrongly displayed (9.2.0740).
      * complete_check() does not return TRUE for mapped input (9.2.0741).
      * filetype: SSH keys and related filetypes not recognized (9.2.0742).
      * string macros silently accept a size of the wrong type (9.2.0743).
      * popup_atcursor() closes immediately on white space (9.2.0744).
      * cscope: connection leak when growing the array fails (9.2.0747).
      * 'autocompletedelay' interferes with CTRL-G U (9.2.0748).
      * 'autocompletedelay' interferes with i_CTRL-K (9.2.0749).
      * completion: 'autocompletedelay' deferral leaks state (9.2.0750).
      * GTK3 GUI is slow under Wayland (9.2.0751).
      * GTK4: drag-and-drop does not support HTML (9.2.0752).
      * GTK GUI deferred redraw skipped on 'lazyredraw' (9.2.0753).
      * repeated completion length lookup in search_for_exact_line         (9.2.0754).
      * 'autocomplete' behaves inconsistently when recording (9.2.0755).
      * session with multiple tabpages sets 'winminheight' to 0 (9.2.0756).
      * tests: test_popupwin fails with zsh because of the prompt         (9.2.0757).
      * pum: no opacity when background not set for Popup menu group         (9.2.0758).
      * some code for 'autocompletedelay' is no longer needed (9.2.0759).
      * compiler warning for using potentially uninitialized var         (9.2.0760).
      * runtime(netrw): Unix: unable to open '\' file (9.2.0761).
      * duplicated sub-option name check in :set completion (9.2.0762).
      * tests: style issue in test_plugin_netrw (9.2.0763).
      * compiler warning about unused function (9.2.0764).
      * popup: opacity popup over a terminal is not cleared when moved         (9.2.0765).
      * quick_tab entries for empty letters point to the wrong index         (9.2.0766).
      * legacy/vim9cmd modifiers do not set script version for options         values (9.2.0767).
      * legacy/vim9cmd modifiers are not exclusive (9.2.0768).
      * conversion to utf-16be using iconv is inconsistent (9.2.0769).
      * dict_add_dict() has inconsistent ownership on failure (9.2.0770).
      * dict_add_list() has inconsistent ownership on failure (9.2.0771).
      * Vim9: null dereference inside alloc_type() (9.2.0772).
      * memory leak in evalfunc.c on alloc failure (9.2.0773).
      * memory leak in f_getscriptinfo() on alloc failure (9.2.0774).
      * memory leak in highlight_get_info() on alloc failure (9.2.0775).
      * memory leak in sign_getlist() on alloc failure (9.2.0776).
      * memory leak in add_defer() on alloc failure (9.2.0777).
      * memory leak in compile_dict() on alloc failure (9.2.0778).
      * memory leak in type_name_func() on alloc failure (9.2.0779).
      * memory leak in evalvars.c on alloc failure (9.2.0780).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8541-1 advisory.

    Hirohito Higashi discovered that Vim incorrectly escaped class or trait names when performing PHP omni-     completion. An attacker could possibly use this issue to trick a user into opening a specially crafted PHP     file and executing arbitrary commands. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and     Ubuntu 26.04 LTS. (CVE-2026-59856)

    Hirohito Higashi discovered that Vim incorrectly handled sound-folding of certain words when using a spell     file. An attacker could possibly use this issue to cause Vim to crash, resulting in a denial of service.
    (CVE-2026-59857)

    It was discovered that Vim incorrectly escaped certain tags file fields when performing C omni-completion.
    An attacker could possibly use this issue to trick a user into opening a specially crafted file and     executing arbitrary commands. (CVE-2026-59858)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of     spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into     a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to     reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A     boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based     spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack     frame and crash the editor. This issue is fixed in version 9.2.0725. (CVE-2026-59857)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
330311	SUSE SLES15 Security Update : vim (SUSE-SU-2026:3271-1)	Nessus	SuSE Local Security Checks	high
330289	SUSE SLES12 Security Update : vim (SUSE-SU-2026:3237-1)	Nessus	SuSE Local Security Checks	high
329214	Vim < 9.2.0725 Out-of-bounds Write (GHSA-m3hf-xcm3-xhm2)	Nessus	Misc.	medium
328920	openSUSE 16 Security Update : vim (openSUSE-SU-2026:21374-1)	Nessus	SuSE Local Security Checks	high
327061	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Vim vulnerabilities (USN-8541-1)	Nessus	Ubuntu Local Security Checks	high
326287	Linux Distros Unpatched Vulnerability : CVE-2026-59857	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-59857

medium

Tenable Plugins

high

high

medium

high

high

medium