Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.

ubuntu_linux USN-8679-1: Ubuntu 14.04 LTS / Ubuntu 16.04 LTS / Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS / Ubuntu 24.04 LTS / Ubuntu Pro Realtime 22.04 LTS / Ubuntu Pro Realtime 24.04 LTS : Vim vulnerability (USN-8679-1)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in
    runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped
    typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command
    separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with
    CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in
    version 9.2.0845. (CVE-2026-73073)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0957 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-73073:
    Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in     runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped     typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command     separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with     CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in     version 9.2.0845.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2108 advisory.

    Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in     src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to     overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which     allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim     server. This issue is fixed in version 9.2.0842. (CVE-2026-73070)

    Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in     src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free     the current buffer, causing the error path to read freed memory instead of reader->js_buf +     reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.
    (CVE-2026-73071)

    Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses     sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an     SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes     beyond a heap allocation. This issue is fixed in version 9.2.0846. (CVE-2026-73072)

    Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in     runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped     typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command     separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with     CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in     version 9.2.0845. (CVE-2026-73073)

    Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses     the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the     count to zero and copying existing text-property records into a heap allocation sized for none of them.
    This issue is fixed in version 9.2.0841. (CVE-2026-73074)

    Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex()     in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and     opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-     bounds read and conditional write. This issue is fixed in version 9.2.0843. (CVE-2026-73075)

    Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a     crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen     commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands,     including operating-system commands invoked through :!, execute with the privileges of the user running     Vim. This issue is fixed in version 9.2.0847. (CVE-2026-73076)

    Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim,     runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-     mode selections from K through keywordprg commands without safely separating shell arguments.
    fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg,     ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands     to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.
    (CVE-2026-73077)

    Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads     netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu     entries by interpolating attacker-controlled directory paths into executed :menu commands.
    s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to     neutralize the | command separator or single quotes at five construction sites, allowing a crafted path     browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is     fixed in version 9.2.0840. (CVE-2026-73078)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3883 advisory.

    Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function     in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken.
    For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it     encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots -- a     base character plus five combining marks -- the bundled libvterm returns the array without a terminating     NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer     reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger     this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in     version 9.2.0565. (CVE-2026-52859)

    Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in     src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes     that apply to a word. The counter is bounded only by the trie structure itself; it is never checked     against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A     crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so     the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the     call frame and crashes the editor. This vulnerability is fixed in 9.2.0662. (CVE-2026-55892)

    Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of     spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte     map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and     terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer     the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell     suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer.
    This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This     vulnerability is fixed in 9.2.0698. (CVE-2026-57455)

    Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of     spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into     a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to     reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A     boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based     spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack     frame and crash the editor. This issue is fixed in version 9.2.0725. (CVE-2026-59857)

    Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in     runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped     typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command     separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with     CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in     version 9.2.0845. (CVE-2026-73073)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Vim installed on the remote host is prior to 9.2.0845. It is, therefore, affected by a command injection vulnerability:

  - StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently     escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command     separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X     CTRL-O on a member access whose type is resolved from that tags file. (CVE-2026-73073)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in     runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped     typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command     separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with     CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in     version 9.2.0845. (CVE-2026-73073)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
460703	Echo: vim: security update to 2:9.2.0858-1	Tenable Cloud Security	Echo Local Security Checks	Local	high
460703	Echo: vim: security update to 2:9.2.0858-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
343522	TencentOS Server 4: vim (TSSA-2026:0957)	Nessus	Tencent Local Security Checks	Local	high
341874	Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-2108)	Nessus	Amazon Linux Local Security Checks	Local	high
341852	Amazon Linux 2 : vim, --advisory ALAS2-2026-3883 (ALAS-2026-3883)	Nessus	Amazon Linux Local Security Checks	Local	high
339352	Vim < 9.2.0845 Command Injection (CVE-2026-73073)	Nessus	Misc.	Local	high
338041	Linux Distros Unpatched Vulnerability : CVE-2026-73073	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-73073

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high