CLSA-2026-1786093276
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093276.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1786093276
- Upstream
- Published
- 2026-08-07T09:01:28Z
- Modified
- 2026-10-26T09:31:52Z
- Summary
- Fix CVE(s): CVE-2026-25749, CVE-2026-34982, CVE-2026-41411
- Details
-
- SECURITY UPDATE: Heap buffer overflow in get_tagfname() in src/tag.c: the user-settable 'helpfile' option value is copied into a fixed MAXPATHL+1-sized heap buffer with an unbounded STRCPY() when help-file tags are resolved, so a 'helpfile' path longer than MAXPATHL writes past the end of the buffer
- debian/patches/CVE-2026-25749.patch: replace the unbounded STRCPY(buf, p_hf) in get_tagfname() with a bounded vim_strncpy() that also leaves room for the "tags" tail appended by the following STRCPY(gettail(buf), "tags"), so the 'helpfile' value can no longer be copied past the end of the caller's MAXPATHL-sized buffer
- CVE-2026-25749
- SECURITY UPDATE: Modeline sandbox bypass allowing arbitrary OS command execution when a crafted file is opened: the 'complete', 'guitabtooltip' and 'printheader' options are missing the P_MLE flag, so a modeline can set them to expressions that are evaluated outside the 'modelineexpr' guard
- debian/patches/CVE-2026-34982.patch: add the P_MLE flag to the 'complete', 'guitabtooltip' and 'printheader' entries of the option table in src/option.c so a modeline can no longer set them while 'modelineexpr' is off; the upstream mapset() hunk is dropped as mapset() does not exist in 8.1.0875
- CVE-2026-34982
- SECURITY UPDATE: Command injection during tag resolution in expand_tag_fname() in src/tag.c: the filename field read from a tags file is passed to ExpandOne() for wildcard and environment-variable expansion, so a crafted tags file containing backtick syntax makes vim execute the embedded command through the shell with the user's privileges
- debian/patches/CVE-2026-41411.patch: guard the wildcard expansion in expand_tag_fname() with vim_strchr(fname, '`') == NULL so a tags-file filename field containing backticks is never handed to ExpandOne() and can no longer reach the shell
- CVE-2026-41411
- SECURITY UPDATE: Heap buffer overflow in get_tagfname() in src/tag.c: the user-settable 'helpfile' option value is copied into a fixed MAXPATHL+1-sized heap buffer with an unbounded STRCPY() when help-file tags are resolved, so a 'helpfile' path longer than MAXPATHL writes past the end of the buffer
- References