Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in build_stl_str_hl() when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.
{
"cwe_ids": [
"CWE-121"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28422.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28422.json"
[
{
"id": "CVE-2026-28422-3d32cca8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"247283241514330503915469176766926974755",
"135730680100787629866409014530148069836",
"29202953099470351876250776989487464260",
"102888948105162382091064915336361188738"
]
},
"signature_type": "Line",
"target": {
"file": "src/buffer.c"
},
"signature_version": "v1",
"source": "https://github.com/vim/vim/commit/4e5b9e31cb7484ad156fba995fdce3c9b075b5fd",
"deprecated": false
},
{
"id": "CVE-2026-28422-adc0390e",
"digest": {
"length": 18487.0,
"function_hash": "41017946210373607016615954362323598929"
},
"signature_type": "Function",
"target": {
"file": "src/buffer.c",
"function": "build_stl_str_hl"
},
"signature_version": "v1",
"source": "https://github.com/vim/vim/commit/4e5b9e31cb7484ad156fba995fdce3c9b075b5fd",
"deprecated": false
},
{
"id": "CVE-2026-28422-be3b82b1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146200493773228420153804765641940418619",
"112207497256799236683616113635496440086",
"246235585315227716991145834696213978793",
"80714956348118375957213855225995134796"
]
},
"signature_type": "Line",
"target": {
"file": "src/version.c"
},
"signature_version": "v1",
"source": "https://github.com/vim/vim/commit/4e5b9e31cb7484ad156fba995fdce3c9b075b5fd",
"deprecated": false
}
]