Vim Prior to 9.2.0075: Malformed Tags File Can Crash the Editor

Summary

Older versions of Vim can crash if it encounters a malformed tags file. This could potentially allow an attacker to make the editor crash or behave unexpectedly. Update to version 9.2.0075 or later to fix the issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
vim	vim	<= 9.2.0075	–

Original title

Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file ...

Original description

Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.

nvd CVSS3.1 6.6

Vulnerability type

CWE-124

CWE-125 Out-of-bounds Read

https://github.com/vim/vim/commit/9b7dfa2948c9e1e5e32a5812 Patch
https://github.com/vim/vim/releases/tag/v9.2.0075 Product
https://github.com/vim/vim/security/advisories/GHSA-xcc8-r6c5-hvwv Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/02/27/8 Mailing List Patch Third Party Advisory