Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28418.json",
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-122",
"CWE-125"
]
}[
{
"id": "CVE-2026-28418-61f91b69",
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb46c3a9e76f684da2d",
"target": {
"file": "src/tag.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"98361488009085434482630743349635588834",
"21964965210244500173354585742213025652",
"201337689959246843777061706814879607943",
"272118255554869134993016983366646239135"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2026-28418-a9c724df",
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb46c3a9e76f684da2d",
"target": {
"function": "emacs_tags_new_filename",
"file": "src/tag.c"
},
"digest": {
"length": 1036.0,
"function_hash": "161804515669411736190930123114054567081"
},
"signature_type": "Function"
},
{
"id": "CVE-2026-28418-ab8d817e",
"signature_version": "v1",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb46c3a9e76f684da2d",
"target": {
"file": "src/version.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"146200493773228420153804765641940418619",
"117776358194581657177046705476953900044",
"142617965372078519022986634548088293692",
"128929277119052141417984891508503780827"
]
},
"signature_type": "Line"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28418.json"