What’s Vulnerable › Vulnerabilities

CVE-2026-34982: Vim modeline bypass via various options affects Vim < 9.2.0276

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-06 · updated 2026-10-24
• Weakness: CWE-78

Description

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

Affected products

• vim/vim: before 9.2.0276 — fixed in 9.2.0276

How to fix

Upgrade to a fixed version: vim/vim 9.2.0276. Check the vendor advisory for mitigations.

References

• https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615
• https://github.com/vim/vim/releases/tag/v9.2.0276
• https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9
• http://www.openwall.com/lists/oss-security/2026/04/01/1
• https://access.redhat.com/errata/RHSA-2026:11389
• https://access.redhat.com/errata/RHSA-2026:11509
• https://access.redhat.com/errata/RHSA-2026:11510
• https://access.redhat.com/errata/RHSA-2026:19073
• https://access.redhat.com/errata/RHSA-2026:19224
• https://access.redhat.com/errata/RHSA-2026:21275
• https://access.redhat.com/errata/RHSA-2026:22634
• https://access.redhat.com/errata/RHSA-2026:28049

Get alerted when CVE-2026-34982 or the next vulnerability affects your stack