Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
Vim Text Editor: Uncontrolled Code Execution Risk
published 4 months ago
Summary
Vim text editor versions up to 9.2.479 contain a critical vulnerability that can allow attackers to execute unauthorized code. This could potentially compromise sensitive data, disrupt normal operations, and even allow unauthorized access to the system. To fix this, update to version 9.2.480 or later.
What to do
- Update openeuler vim to version 9.0-49.oe2203sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:22.03-LTS-SP4 | openeuler | vim |
< 9.0-49.oe2203sp4 Fix: upgrade to 9.0-49.oe2203sp4
|
Original advisory text
vim security update
Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor &apos;Vi&apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.
Security Fix(es):
A vulnerability has been found in vim up to 9.2.479 (Word Processing Software) and classified as critical. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. Upgrading to version 9.2.480 eliminates this vulnerability.(CVE-2026-43961)
Security Fix(es):
A vulnerability has been found in vim up to 9.2.479 (Word Processing Software) and classified as critical. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. Upgrading to version 9.2.480 eliminates this vulnerability.(CVE-2026-43961)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-43961 Vendor Advisory
Severity
4.8
Medium
Timeline
Published12 Jun 2026
Updated21 Aug 2026
First seen12 Jun 2026
Sources
OESA-2026-2686 · OSV
Track software like this
Free during beta