CLSA-2026-1789464785
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1789464785.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789464785
- Upstream
- Published
- 2026-09-15T09:33:17Z
- Modified
- 2026-10-26T09:30:54Z
- Summary
- vim: Fix of 3 CVEs
- Details
-
- CVE-2026-73072: fix heap buffer overflow in set_sofo(); reset sl_sal_first[] before the SN_SOFO counting loop, since a preceding SN_SAL section may have set its entries to -1 via set_sal_first(), making the loop under-count colliding multi-byte characters and allocate an undersized list (src/spellfile.c, upstream patch 9.2.0846)
- CVE-2026-73076: fix arbitrary code execution via a crafted .VimballRecord file; refuse to extract a member named .VimballRecord, record deletions with string() instead of raw quote interpolation, and execute only whitelisted call delete() entries in vimball#RmVimball() (runtime/autoload/vimball.vim, upstream patch 9.2.0847)
- CVE-2026-73078: fix Ex command injection in the netrw bookmark and history menus; add the Ex separator | to g:netrw_menu_escape, escape the :e targets with fnameescape(), and quote the netrw#MakeTgt() arguments with string() (runtime/autoload/netrw.vim, upstream patch 9.2.0840)
- References