CVE-2026-73071
Received Received - Intake

Heap Buffer Overflow in Vim Text Editor

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73071
EUVD
EUVD-2026-56225

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vim vim 9.2.0844
vim vim From 9.2.0511 (inc) to 9.2.0844 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73071 is a use-after-free vulnerability in Vim's JSON decoding functionality affecting versions 9.2.0511 to 9.2.0843. When decoding a JSON message that spans multiple buffers, the decoder frees the old buffer but retains a pointer to it. If an error occurs later, such as an invalid escape sequence, the error handling code reads from this freed memory, potentially causing crashes or exposing memory contents.

Detection Guidance

Detecting this vulnerability requires checking if your Vim version is between 9.2.0511 and 9.2.0843. Run 'vim --version' to check the version. If it falls in this range, the system is vulnerable. No specific commands detect active exploitation, but monitoring for crashes during JSON parsing may indicate issues.

Impact Analysis

This vulnerability could allow an attacker to crash the Vim process or read freed memory by sending a malformed JSON message split across multiple buffers. Exploitation requires the victim to process a specially crafted JSON message, such as via a socket server or user-opened JSON channel. The impact is limited to local or peer-controlled environments.

Mitigation Strategies

Upgrade Vim to version 9.2.0844 or later immediately. If upgrading is not possible, avoid using Vim's JSON channel features, especially with untrusted input or network sources. Disable the socket server backend if enabled (--servername).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73071. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart