What’s Vulnerable › Vulnerabilities

CVE-2026-28420: Vim has Heap-based Buffer Overflow and OOB Read in :terminal

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-27 · updated 2026-06-17
• Weakness: CWE-122

Description

Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.

Affected products

• vim/vim: before 9.2.0076 — fixed in 9.2.0076

How to fix

Upgrade to a fixed version: vim/vim 9.2.0076. Check the vendor advisory for mitigations.

References

• https://github.com/vim/vim/commit/bb6de2105b160e729c34063
• https://github.com/vim/vim/releases/tag/v9.2.0076
• https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg
• http://www.openwall.com/lists/oss-security/2026/02/27/9

Get alerted when CVE-2026-28420 or the next vulnerability affects your stack