AZL-91098

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91098.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-91098
Upstream
Published
2026-06-25T16:16:42Z
Modified
2026-08-28T17:48:11Z
Summary
CVE-2026-57452 affecting package vim for versions less than 9.2.0735-1
Details

Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt04! or VimCrypt05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.

References

Affected packages

Azure Linux:3 / vim

Package

Name
vim
Purl
pkg:rpm/azure-linux/vim

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.2.0735-1

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91098.json"