{"schemaVersion":3,"id":"USN-8246-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"vim vulnerabilities\n\nMichał Majchrowicz discovered that Vim’s zip plugin could overwrite\narbitrary files. An attacker could possibly use this issue to delete\nsensitive data or execute arbitrary code. This issue only affected\nUbuntu 26.04 LTS. (CVE-2026-35177)\n\nIt was discovered that Vim’s netbeans interface did not properly\nsanitize certain strings. An attacker could possibly use this issue to\nexecute arbitrary commands. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-39881)\n\nIt was discovered that Vim did not properly handle backticks in tag\nfilenames. An attacker could possibly use this issue to execute arbitrary\ncommands. (CVE-2026-41411)","dates":{"published":"2026-05-07T14:58:11.000Z","modified":"2026-05-20T16:04:05.283Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"vim","name":"vim","label":"vim","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/vim","purlType":"deb","versions":[{"text":"< 2:8.2.3995-1ubuntu2.29","noFixRecorded":false,"fixedIn":null},{"text":"< 2:9.1.0016-1ubuntu7.13","noFixRecorded":false,"fixedIn":null},{"text":"< 2:9.1.0967-1ubuntu6.4","noFixRecorded":false,"fixedIn":null},{"text":"< 2:9.1.2141-1ubuntu4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2:8.2.3995-1ubuntu2.29 | < 2:9.1.0016-1ubuntu7.13 | < 2:9.1.0967-1ubuntu6.4 | < 2:9.1.2141-1ubuntu4.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8246-1","label":"ubuntu.com/security/notices/USN-8246-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-35177","label":"ubuntu.com/security/CVE-2026-35177","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-39881","label":"ubuntu.com/security/CVE-2026-39881","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-41411","label":"ubuntu.com/security/CVE-2026-41411","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CVE-2026-35177","CVE-2026-39881","CVE-2026-41411"]},"timeline":[{"kind":"published","date":"2026-05-07T14:58:11.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-05-20T16:04:05.283Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T18:45:45.261Z","stale":false,"partial":false}}