CVE-2026-73076
Received Received - Intake

Vimball Arbitrary Command Execution in Vim

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73076
EUVD
EUVD-2026-56231

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vim vim 9.2.0847

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73076 is a vulnerability in Vim where a crafted vimball member named .VimballRecord can overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() processes this record later, the stored commands execute with the user's privileges.

Detection Guidance

Check for installed Vim versions below 9.2.0847 using 'vim --version'. Inspect vimball plugins for .VimballRecord files in runtime directories. Look for unexpected command execution logs or system changes after installing vimballs from untrusted sources.

Impact Analysis

If you install a vimball from an untrusted source, an attacker could execute arbitrary commands on your system with your user privileges. This could lead to data theft, system compromise, or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data privacy) by exposing sensitive information. Compliance may require patching and auditing affected systems.

Mitigation Strategies

Upgrade Vim to version 9.2.0847 or later. Avoid installing vimballs from untrusted sources. Remove any existing .VimballRecord files in Vim runtime directories. Review system logs for suspicious command executions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73076. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart