Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.
{
"cwe_ids": [
"CWE-122"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25749.json"
}[
{
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9",
"id": "CVE-2026-25749-36bda32a",
"target": {
"file": "src/version.c"
},
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"310112497628628922976723877551880085152",
"62643629379883779316300416597800071658",
"334446945731690758825156916482150078267"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9",
"id": "CVE-2026-25749-a183d31e",
"target": {
"file": "src/tag.c",
"function": "get_tagfname"
},
"digest": {
"function_hash": "26155307912537087175034485652842959246",
"length": 2104.0
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9",
"id": "CVE-2026-25749-d19c46d1",
"target": {
"file": "src/tag.c"
},
"digest": {
"line_hashes": [
"124251216950284502676404341243906933042",
"19449048083432185681868735931095318517",
"321767517306288301976054374439286753861",
"53936595837070922265515405533475922751"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25749.json"