CVE-2026-39881: vim Code Injection
Vulnerability summary
CVE-2026-39881 is a high (CVSS 7.8) Code Injection vulnerability in vim. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 08-04-2026PublishedVulnerability first disclosed.
- 09-04-2026Last modifiedVulnerability information updated.
Description
Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA5.0MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.76%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
+0.14 pp
From 0.62% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- vim< 9.2.0321-r0
Debian1 product
- vimAll versions (No fix recorded) | < 2:9.2.0338-1
Ubuntu1 product
- vim< 2:7.4.052-1ubuntu3.1+esm25 | < 2:7.4.1689-3ubuntu1.5+esm31 | < 2:8.0.1453-1ubuntu1.13+esm16 | < 2:8.1.2269-1ubuntu5.32+esm4 | < 2:8.2.3995-1ubuntu2.28 | < 2:9.1.0016-1ubuntu7.12 | < 2:9.1.0967-1ubuntu6.3 | < 2:9.1.2141-1ubuntu4.1
Vim1 product
- vim< 9.2.0316
4 vendors · 4 products
