CVE-2026-34714

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-30 · updated 2026-09-01
Weakness: CWE-78

Description

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Affected products

vim/vim: from 9.1.1390 before 9.2.0272 — fixed in 9.2.0272

How to fix

Upgrade to a fixed version: vim/vim 9.2.0272. Check the vendor advisory for mitigations.

References

https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459
https://github.com/vim/vim/releases/tag/v9.2.0272
https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh
https://www.openwall.com/lists/oss-security/2026/03/30/3
http://www.openwall.com/lists/oss-security/2026/04/02/4
http://www.openwall.com/lists/oss-security/2026/04/02/5
http://www.openwall.com/lists/oss-security/2026/04/03/6
https://access.redhat.com/security/cve/CVE-2026-34714
https://bugzilla.redhat.com/show_bug.cgi?id=2453139
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34714.json

Get alerted when CVE-2026-34714 or the next vulnerability affects your stack