CVE-2026-73077
Received Received - Intake

Heap-Based Buffer Overflow in Vim Text Editor

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73077
EUVD
EUVD-2026-56233

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vim vim to 9.2.0839 (exc)
vim vim to 9.2.0839 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73077 is a vulnerability in Vim versions before 9.2.0839 that allows arbitrary command execution. It occurs in shell filetype plugins (sh.vim, zsh.vim, ps1.vim) where Visual-mode selections are passed unsafely to shell commands like bash, zsh, or PowerShell without proper escaping. When a user selects crafted text and presses 'K', the input is executed as a shell command with the user's privileges.

Detection Guidance

Check if your Vim version is prior to 9.2.0839 by running: vim --version | grep '9.2.0839'. If the version is older, the system is vulnerable. Inspect filetype plugins for sh.vim, zsh.vim, or ps1.vim in runtime/ftplugin/ for improper shell argument handling.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary commands on your system if you use a vulnerable Vim version and trigger the keyword lookup feature. The attack requires you to manually select malicious text in Visual mode and press 'K'. Successful exploitation could lead to data theft, system compromise, or further malware installation, depending on your user privileges.

Mitigation Strategies

Upgrade Vim to version 9.2.0839 or later immediately. Disable filetype plugins if not needed or review their configurations to ensure proper shell argument escaping. Avoid using Visual mode with untrusted files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73077. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart