What’s Vulnerable › Vulnerabilities

CVE-2026-73071: Vim: Use-after-free in JSON Decoding

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-06
• Weakness: CWE-416

Description

Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.

Affected products

• vim/vim: from 9.2.0511 before 9.2.0844 — fixed in 9.2.0844

How to fix

Upgrade to a fixed version: vim/vim 9.2.0844. Check the vendor advisory for mitigations.

References

• https://github.com/vim/vim/commit/f8126294a526aa80c5123eb3079e325daee9ec75
• https://github.com/vim/vim/releases/tag/v9.2.0844
• https://github.com/vim/vim/security/advisories/GHSA-69ch-22ch-r887

Get alerted when CVE-2026-73071 or the next vulnerability affects your stack