Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
CVSS Details
- CVSS 4.0 Base Score: 8.4 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade vim | Aug 19, 2026 | Aug 11, 2026 |
| Amazon_linux_2023 | — | Upgrade vim-minimal-debuginfoUpgrade xxd-debuginfoUpgrade vim-debuginfoUpgrade xxdUpgrade vim-dataUpgrade vim-debugsourceUpgrade vim-filesystemUpgrade vim-commonUpgrade vim-minimalUpgrade vim-enhanced-debuginfoUpgrade vim-default-editorUpgrade vim-enhanced | Sep 1, 2026 | Aug 11, 2026 |
| Redhat_linux | — | Upgrade vim-X11Upgrade vim-commonUpgrade vim-debugsourceUpgrade vim-common-debuginfoUpgrade vim-minimalUpgrade xxd-debuginfoUpgrade vim-X11-debuginfoUpgrade xxdUpgrade vim-enhanced-debuginfoUpgrade vim-filesystemUpgrade vim-enhancedUpgrade vim-debuginfoUpgrade vim-minimal-debuginfoUpgrade vim-dataNo solution exists | Aug 17, 2026 | Aug 11, 2026 |
| Rocky_linux | — | Upgrade vim-X11Upgrade vim-debuginfoUpgrade xxd-debuginfoUpgrade vim-minimal-debuginfoUpgrade vim-X11-debuginfoUpgrade vim-enhanced-debuginfoUpgrade xxdUpgrade vim-common-debuginfoUpgrade vim-enhancedUpgrade vim-commonUpgrade vim-debugsourceUpgrade vim-minimal | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade vim-gtkUpgrade vim-tiny (Ubuntu Pro)Upgrade vim-common (Ubuntu Pro)Upgrade vim-athenaUpgrade vim-gnome-py2 (Ubuntu Pro)Upgrade vim-gtk (Ubuntu Pro)Upgrade vim-tinyUpgrade vim-noxUpgrade vim-nox-py2 (Ubuntu Pro)Upgrade vim-gui-common (Ubuntu Pro)Upgrade xxdUpgrade vimUpgrade vim (Ubuntu Pro)Upgrade vim-athena (Ubuntu Pro)Upgrade vim-gtk3 (Ubuntu Pro)Upgrade vim-runtime (Ubuntu Pro)Upgrade vim-commonUpgrade vim-gtk3Upgrade xxd (Ubuntu Pro)Upgrade vim-lesstif (Ubuntu Pro)Upgrade vim-gtk-py2 (Ubuntu Pro)Upgrade vim-nox (Ubuntu Pro)Upgrade vim-athena-py2 (Ubuntu Pro)Upgrade vim-motifUpgrade vim-gnome (Ubuntu Pro)Upgrade vim-runtimeUpgrade vim-gui-commonUpgrade vim-gtk3-py2 (Ubuntu Pro) | Aug 23, 2026 | Aug 20, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Aug 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub