{"schemaVersion":3,"id":"USN-8657-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"vim vulnerabilities\n\nIt was discovered that Vim incorrectly handled memory when decoding\ncertain JSON input. An attacker could possibly use this issue to cause\nVim to crash, resulting in a denial of service. This issue only affected\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-73071)\n\nYazan Balawneh discovered that Vim incorrectly handled memory when\nopening certain spell files. An attacker could possibly use this issue to\ncause Vim to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2026-73072)\n\nIt was discovered that Vim incorrectly handled memory when processing\ncertain files with a large number of text properties. An attacker could\npossibly use this issue to cause Vim to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-73074)\n\nIt was discovered that Vim incorrectly handled certain vimball files. An\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-73076)\n\nIt was discovered that Vim incorrectly handled shell arguments during\nkeyword lookups. An attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04\nLTS, and Ubuntu 26.04 LTS. (CVE-2026-73077)\n\nDavid Carliez discovered that Vim incorrectly handled certain directory\npaths when constructing netrw menus. An attacker could possibly use this\nissue to execute arbitrary code. (CVE-2026-73078)","dates":{"published":"2026-08-20T22:03:08.000Z","modified":"2026-10-08T12:48:07.010Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"vim","name":"vim","label":"vim","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/vim","purlType":"deb","versions":[{"text":"< 2:7.4.052-1ubuntu3.1+esm32","noFixRecorded":false,"fixedIn":null},{"text":"< 2:7.4.1689-3ubuntu1.5+esm38","noFixRecorded":false,"fixedIn":null},{"text":"< 2:8.0.1453-1ubuntu1.13+esm23","noFixRecorded":false,"fixedIn":null},{"text":"< 2:8.1.2269-1ubuntu5.32+esm12","noFixRecorded":false,"fixedIn":null},{"text":"< 2:8.2.3995-1ubuntu2.35","noFixRecorded":false,"fixedIn":null},{"text":"< 2:9.1.0016-1ubuntu7.19","noFixRecorded":false,"fixedIn":null},{"text":"< 2:9.1.2141-1ubuntu4.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2:7.4.052-1ubuntu3.1+esm32 | < 2:7.4.1689-3ubuntu1.5+esm38 | < 2:8.0.1453-1ubuntu1.13+esm23 | < 2:8.1.2269-1ubuntu5.32+esm12 | < 2:8.2.3995-1ubuntu2.35 | < 2:9.1.0016-1ubuntu7.19 | < 2:9.1.2141-1ubuntu4.8","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8657-1","label":"ubuntu.com/security/notices/USN-8657-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-28417","label":"ubuntu.com/security/CVE-2026-28417","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-73071","label":"ubuntu.com/security/CVE-2026-73071","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-73072","label":"ubuntu.com/security/CVE-2026-73072","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-73074","label":"ubuntu.com/security/CVE-2026-73074","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-73076","label":"ubuntu.com/security/CVE-2026-73076","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-73077","label":"ubuntu.com/security/CVE-2026-73077","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-73078","label":"ubuntu.com/security/CVE-2026-73078","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2026-28417","CVE-2026-73071","CVE-2026-73072","CVE-2026-73074","CVE-2026-73076","CVE-2026-73077","CVE-2026-73078"],"downstream":[],"duplicates":[],"related":["CVE-2026-73071","CVE-2026-73072","CVE-2026-73074","CVE-2026-73076","CVE-2026-73077","CVE-2026-73078"]},"timeline":[{"kind":"published","date":"2026-08-20T22:03:08.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-08T12:48:07.010Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T01:14:15.974Z","stale":false,"partial":false}}