CVE-2026-34714

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34714
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34714.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34714
Aliases
  • GHSA-2gmj-rpqf-pxvh
Downstream
Related
Published
2026-03-30T18:27:55Z
Modified
2026-09-03T08:05:37Z
Severity
  • 9.2 (Critical) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L CVSS Calculator
Summary
[none]
Details

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Database specific 
{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34714.json"
}
References

Affected packages

Git / github.com/vim/vim

Affected ranges

Type
GIT
Repo
https://github.com/vim/vim
Events
Introduced
e89aef3f65388a8b627c77f250525f2a264716c5
Fixed
664701eb7576edb7c7c7d9f2d600815ec1f43459
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.2.0272"
        },
        {
            "introduced": "9.1.1390"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v9.*
v9.1.1390
v9.1.1391
v9.1.1393
v9.1.1394
v9.1.1395
v9.1.1396
v9.1.1397
v9.1.1398
v9.1.1399
v9.1.1400
v9.1.1401
v9.1.1402
v9.1.1403
v9.1.1404
v9.1.1405
v9.1.1406
v9.1.1407
v9.1.1408
v9.1.1409
v9.1.1410
v9.1.1411
v9.1.1412
v9.1.1413
v9.1.1414
v9.1.1415
v9.1.1416
v9.1.1417
v9.1.1418
v9.1.1419
v9.1.1420
v9.1.1421
v9.1.1422
v9.1.1423
v9.1.1424
v9.1.1425
v9.1.1426
v9.1.1427
v9.1.1428
v9.1.1429
v9.1.1430
v9.1.1431
v9.1.1432
v9.1.1433
v9.1.1434
v9.1.1435
v9.1.1436
v9.1.1437
v9.1.1438
v9.1.1439
v9.1.1440
v9.1.1441
v9.1.1442
v9.1.1443
v9.1.1444
v9.1.1445
v9.1.1446
v9.1.1447
v9.1.1448
v9.1.1449
v9.1.1450
v9.1.1451
v9.1.1452
v9.1.1453
v9.1.1454
v9.1.1455
v9.1.1456
v9.1.1457
v9.1.1458
v9.1.1459
v9.1.1460
v9.1.1461
v9.1.1462
v9.1.1463
v9.1.1464
v9.1.1465
v9.1.1466
v9.1.1467
v9.1.1468
v9.1.1469
v9.1.1470
v9.1.1471
v9.1.1472
v9.1.1473
v9.1.1474
v9.1.1475
v9.1.1476
v9.1.1477
v9.1.1478
v9.1.1479
v9.1.1480
v9.1.1481
v9.1.1482
v9.1.1483
v9.1.1484
v9.1.1485
v9.1.1486
v9.1.1487
v9.1.1488
v9.1.1489
v9.1.1490
v9.1.1491
v9.1.1492
v9.1.1493
v9.1.1494
v9.1.1495
v9.1.1496
v9.1.1497
v9.1.1498
v9.1.1499
v9.1.1500
v9.1.1501
v9.1.1502
v9.1.1503
v9.1.1504
v9.1.1505
v9.1.1506
v9.1.1507
v9.1.1508
v9.1.1509
v9.1.1510
v9.1.1511
v9.1.1512
v9.1.1513
v9.1.1514
v9.1.1515
v9.1.1516
v9.1.1517
v9.1.1518
v9.1.1519
v9.1.1520
v9.1.1521
v9.1.1522
v9.1.1523
v9.1.1524
v9.1.1525
v9.1.1526
v9.1.1527
v9.1.1528
v9.1.1529
v9.1.1530
v9.1.1531
v9.1.1532
v9.1.1533
v9.1.1534
v9.1.1535
v9.1.1536
v9.1.1537
v9.1.1538
v9.1.1539
v9.1.1540
v9.1.1541
v9.1.1542
v9.1.1543
v9.1.1544
v9.1.1545
v9.1.1546
v9.1.1547
v9.1.1548
v9.1.1549
v9.1.1550
v9.1.1551
v9.1.1552
v9.1.1553
v9.1.1554
v9.1.1555
v9.1.1556
v9.1.1557
v9.1.1558
v9.1.1559
v9.1.1560
v9.1.1561
v9.1.1562
v9.1.1563
v9.1.1564
v9.1.1565
v9.1.1566
v9.1.1567
v9.1.1568
v9.1.1569
v9.1.1570
v9.1.1571
v9.1.1572
v9.1.1573
v9.1.1574
v9.1.1575
v9.1.1576
v9.1.1577
v9.1.1578
v9.1.1579
v9.1.1580
v9.1.1581
v9.1.1582
v9.1.1583
v9.1.1584
v9.1.1585
v9.1.1586
v9.1.1587
v9.1.1588
v9.1.1589
v9.1.1590
v9.1.1591
v9.1.1592
v9.1.1593
v9.1.1594
v9.1.1595
v9.1.1596
v9.1.1597
v9.1.1598
v9.1.1599
v9.1.1600
v9.1.1601
v9.1.1602
v9.1.1603
v9.1.1604
v9.1.1605
v9.1.1606
v9.1.1607
v9.1.1608
v9.1.1609
v9.1.1610
v9.1.1611
v9.1.1612
v9.1.1613
v9.1.1614
v9.1.1615
v9.1.1616
v9.1.1617
v9.1.1618
v9.1.1619
v9.1.1620
v9.1.1621
v9.1.1622
v9.1.1623
v9.1.1624
v9.1.1625
v9.1.1626
v9.1.1627
v9.1.1628
v9.1.1629
v9.1.1630
v9.1.1631
v9.1.1632
v9.1.1633
v9.1.1634
v9.1.1635
v9.1.1636
v9.1.1637
v9.1.1638
v9.1.1639
v9.1.1640
v9.1.1641
v9.1.1642
v9.1.1643
v9.1.1644
v9.1.1645
v9.1.1646
v9.1.1647
v9.1.1648
v9.1.1649
v9.1.1650
v9.1.1651
v9.1.1652
v9.1.1653
v9.1.1654
v9.1.1655
v9.1.1656
v9.1.1657
v9.1.1658
v9.1.1659
v9.1.1660
v9.1.1661
v9.1.1662
v9.1.1663
v9.1.1664
v9.1.1665
v9.1.1666
v9.1.1667
v9.1.1668
v9.1.1669
v9.1.1670
v9.1.1671
v9.1.1672
v9.1.1673
v9.1.1674
v9.1.1675
v9.1.1676
v9.1.1677
v9.1.1678
v9.1.1679
v9.1.1680
v9.1.1681
v9.1.1682
v9.1.1683
v9.1.1684
v9.1.1685
v9.1.1686
v9.1.1687
v9.1.1688
v9.1.1689
v9.1.1690
v9.1.1691
v9.1.1692
v9.1.1693
v9.1.1694
v9.1.1695
v9.1.1696
v9.1.1697
v9.1.1698
v9.1.1699
v9.1.1700
v9.1.1701
v9.1.1702
v9.1.1703
v9.1.1704
v9.1.1705
v9.1.1706
v9.1.1707
v9.1.1708
v9.1.1709
v9.1.1710
v9.1.1711
v9.1.1712
v9.1.1713
v9.1.1714
v9.1.1715
v9.1.1716
v9.1.1717
v9.1.1718
v9.1.1719
v9.1.1720
v9.1.1721
v9.1.1722
v9.1.1723
v9.1.1724
v9.1.1725
v9.1.1726
v9.1.1727
v9.1.1728
v9.1.1729
v9.1.1730
v9.1.1731
v9.1.1732
v9.1.1733
v9.1.1734
v9.1.1735
v9.1.1736
v9.1.1737
v9.1.1738
v9.1.1739
v9.1.1740
v9.1.1741
v9.1.1742
v9.1.1743
v9.1.1744
v9.1.1745
v9.1.1746
v9.1.1747
v9.1.1748
v9.1.1749
v9.1.1750
v9.1.1751
v9.1.1752
v9.1.1753
v9.1.1754
v9.1.1755
v9.1.1756
v9.1.1757
v9.1.1758
v9.1.1759
v9.1.1760
v9.1.1761
v9.1.1762
v9.1.1763
v9.1.1764
v9.1.1765
v9.1.1766
v9.1.1767
v9.1.1768
v9.1.1769
v9.1.1770
v9.1.1771
v9.1.1772
v9.1.1773
v9.1.1774
v9.1.1775
v9.1.1776
v9.1.1777
v9.1.1778
v9.1.1779
v9.1.1780
v9.1.1781
v9.1.1782
v9.1.1783
v9.1.1784
v9.1.1785
v9.1.1786
v9.1.1787
v9.1.1788
v9.1.1789
v9.1.1790
v9.1.1791
v9.1.1792
v9.1.1793
v9.1.1794
v9.1.1795
v9.1.1796
v9.1.1797
v9.1.1798
v9.1.1799
v9.1.1800
v9.1.1801
v9.1.1802
v9.1.1803
v9.1.1804
v9.1.1805
v9.1.1806
v9.1.1807
v9.1.1808
v9.1.1809
v9.1.1810
v9.1.1811
v9.1.1812
v9.1.1813
v9.1.1814
v9.1.1815
v9.1.1816
v9.1.1817
v9.1.1818
v9.1.1819
v9.1.1820
v9.1.1821
v9.1.1822
v9.1.1823
v9.1.1824
v9.1.1825
v9.1.1826
v9.1.1827
v9.1.1828
v9.1.1829
v9.1.1830
v9.1.1831
v9.1.1832
v9.1.1833
v9.1.1834
v9.1.1835
v9.1.1836
v9.1.1837
v9.1.1838
v9.1.1839
v9.1.1840
v9.1.1841
v9.1.1842
v9.1.1843
v9.1.1844
v9.1.1845
v9.1.1846
v9.1.1847
v9.1.1848
v9.1.1849
v9.1.1850
v9.1.1851
v9.1.1852
v9.1.1853
v9.1.1854
v9.1.1855
v9.1.1856
v9.1.1857
v9.1.1858
v9.1.1859
v9.1.1860
v9.1.1861
v9.1.1862
v9.1.1863
v9.1.1864
v9.1.1865
v9.1.1866
v9.1.1867
v9.1.1868
v9.1.1869
v9.1.1870
v9.1.1871
v9.1.1872
v9.1.1873
v9.1.1874
v9.1.1875
v9.1.1876
v9.1.1877
v9.1.1878
v9.1.1879
v9.1.1880
v9.1.1881
v9.1.1882
v9.1.1883
v9.1.1884
v9.1.1885
v9.1.1886
v9.1.1887
v9.1.1888
v9.1.1889
v9.1.1890
v9.1.1891
v9.1.1892
v9.1.1893
v9.1.1894
v9.1.1895
v9.1.1896
v9.1.1897
v9.1.1898
v9.1.1899
v9.1.1900
v9.1.1901
v9.1.1902
v9.1.1903
v9.1.1904
v9.1.1905
v9.1.1906
v9.1.1907
v9.1.1908
v9.1.1909
v9.1.1910
v9.1.1911
v9.1.1912
v9.1.1913
v9.1.1914
v9.1.1915
v9.1.1916
v9.1.1917
v9.1.1918
v9.1.1919
v9.1.1920
v9.1.1921
v9.1.1922
v9.1.1923
v9.1.1924
v9.1.1925
v9.1.1926
v9.1.1927
v9.1.1928
v9.1.1929
v9.1.1930
v9.1.1931
v9.1.1932
v9.1.1933
v9.1.1934
v9.1.1935
v9.1.1936
v9.1.1937
v9.1.1938
v9.1.1939
v9.1.1940
v9.1.1941
v9.1.1942
v9.1.1943
v9.1.1944
v9.1.1945
v9.1.1946
v9.1.1947
v9.1.1948
v9.1.1949
v9.1.1950
v9.1.1951
v9.1.1952
v9.1.1953
v9.1.1954
v9.1.1955
v9.1.1956
v9.1.1957
v9.1.1958
v9.1.1959
v9.1.1960
v9.1.1961
v9.1.1962
v9.1.1963
v9.1.1964
v9.1.1965
v9.1.1966
v9.1.1967
v9.1.1968
v9.1.1969
v9.1.1970
v9.1.1971
v9.1.1972
v9.1.1973
v9.1.1974
v9.1.1975
v9.1.1976
v9.1.1977
v9.1.1978
v9.1.1979
v9.1.1980
v9.1.1981
v9.1.1982
v9.1.1983
v9.1.1984
v9.1.1985
v9.1.1986
v9.1.1987
v9.1.1988
v9.1.1989
v9.1.1990
v9.1.1991
v9.1.1992
v9.1.1993
v9.1.1994
v9.1.1995
v9.1.1996
v9.1.1997
v9.1.1998
v9.1.1999
v9.1.2000
v9.1.2001
v9.1.2002
v9.1.2003
v9.1.2004
v9.1.2005
v9.1.2006
v9.1.2007
v9.1.2008
v9.1.2009
v9.1.2010
v9.1.2011
v9.1.2012
v9.1.2013
v9.1.2014
v9.1.2015
v9.1.2016
v9.1.2017
v9.1.2018
v9.1.2019
v9.1.2020
v9.1.2021
v9.1.2022
v9.1.2023
v9.1.2024
v9.1.2025
v9.1.2026
v9.1.2027
v9.1.2028
v9.1.2029
v9.1.2030
v9.1.2031
v9.1.2032
v9.1.2033
v9.1.2034
v9.1.2035
v9.1.2036
v9.1.2037
v9.1.2038
v9.1.2039
v9.1.2040
v9.1.2041
v9.1.2042
v9.1.2043
v9.1.2044
v9.1.2045
v9.1.2046
v9.1.2047
v9.1.2048
v9.1.2049
v9.1.2050
v9.1.2051
v9.1.2052
v9.1.2053
v9.1.2054
v9.1.2055
v9.1.2056
v9.1.2057
v9.1.2058
v9.1.2059
v9.1.2060
v9.1.2061
v9.1.2062
v9.1.2063
v9.1.2064
v9.1.2065
v9.1.2066
v9.1.2067
v9.1.2068
v9.1.2069
v9.1.2070
v9.1.2071
v9.1.2072
v9.1.2073
v9.1.2074
v9.1.2075
v9.1.2076
v9.1.2077
v9.1.2078
v9.1.2079
v9.1.2080
v9.1.2081
v9.1.2082
v9.1.2083
v9.1.2084
v9.1.2085
v9.1.2086
v9.1.2087
v9.1.2088
v9.1.2089
v9.1.2090
v9.1.2091
v9.1.2092
v9.1.2093
v9.1.2094
v9.1.2095
v9.1.2096
v9.1.2097
v9.1.2098
v9.1.2099
v9.1.2100
v9.1.2101
v9.1.2102
v9.1.2103
v9.1.2104
v9.1.2105
v9.1.2106
v9.1.2107
v9.1.2108
v9.1.2109
v9.1.2110
v9.1.2111
v9.1.2112
v9.1.2113
v9.1.2114
v9.1.2115
v9.1.2116
v9.1.2117
v9.1.2118
v9.1.2119
v9.1.2120
v9.1.2121
v9.1.2122
v9.1.2123
v9.1.2124
v9.1.2125
v9.1.2126
v9.1.2127
v9.1.2128
v9.1.2129
v9.1.2130
v9.1.2131
v9.1.2132
v9.1.2133
v9.1.2134
v9.1.2135
v9.1.2136
v9.1.2137
v9.1.2138
v9.1.2139
v9.1.2140
v9.1.2141
v9.1.2142
v9.1.2143
v9.1.2144
v9.1.2145
v9.1.2146
v9.1.2147
v9.1.2148
v9.2.0
v9.2.0000
v9.2.0001
v9.2.0002
v9.2.0003
v9.2.0004
v9.2.0005
v9.2.0006
v9.2.0007
v9.2.0008
v9.2.0009
v9.2.0010
v9.2.0011
v9.2.0012
v9.2.0013
v9.2.0014
v9.2.0015
v9.2.0016
v9.2.0017
v9.2.0018
v9.2.0019
v9.2.0020
v9.2.0021
v9.2.0022
v9.2.0023
v9.2.0024
v9.2.0025
v9.2.0026
v9.2.0027
v9.2.0028
v9.2.0029
v9.2.0030
v9.2.0031
v9.2.0032
v9.2.0033
v9.2.0034
v9.2.0035
v9.2.0036
v9.2.0037
v9.2.0038
v9.2.0039
v9.2.0040
v9.2.0041
v9.2.0042
v9.2.0043
v9.2.0044
v9.2.0045
v9.2.0046
v9.2.0047
v9.2.0048
v9.2.0049
v9.2.0050
v9.2.0051
v9.2.0052
v9.2.0053
v9.2.0054
v9.2.0055
v9.2.0056
v9.2.0057
v9.2.0058
v9.2.0059
v9.2.0060
v9.2.0061
v9.2.0062
v9.2.0063
v9.2.0064
v9.2.0065
v9.2.0066
v9.2.0067
v9.2.0068
v9.2.0069
v9.2.0070
v9.2.0071
v9.2.0072
v9.2.0073
v9.2.0074
v9.2.0075
v9.2.0076
v9.2.0077
v9.2.0078
v9.2.0079
v9.2.0080
v9.2.0081
v9.2.0082
v9.2.0083
v9.2.0084
v9.2.0085
v9.2.0086
v9.2.0087
v9.2.0088
v9.2.0089
v9.2.0090
v9.2.0091
v9.2.0092
v9.2.0093
v9.2.0094
v9.2.0095
v9.2.0096
v9.2.0097
v9.2.0098
v9.2.0099
v9.2.0100
v9.2.0101
v9.2.0102
v9.2.0103
v9.2.0104
v9.2.0105
v9.2.0106
v9.2.0107
v9.2.0108
v9.2.0109
v9.2.0110
v9.2.0111
v9.2.0112
v9.2.0113
v9.2.0114
v9.2.0115
v9.2.0116
v9.2.0117
v9.2.0118
v9.2.0119
v9.2.0120
v9.2.0121
v9.2.0122
v9.2.0123
v9.2.0124
v9.2.0125
v9.2.0126
v9.2.0127
v9.2.0128
v9.2.0129
v9.2.0130
v9.2.0131
v9.2.0132
v9.2.0133
v9.2.0134
v9.2.0135
v9.2.0136
v9.2.0137
v9.2.0138
v9.2.0139
v9.2.0140
v9.2.0141
v9.2.0142
v9.2.0143
v9.2.0144
v9.2.0145
v9.2.0146
v9.2.0147
v9.2.0148
v9.2.0149
v9.2.0150
v9.2.0151
v9.2.0152
v9.2.0153
v9.2.0154
v9.2.0155
v9.2.0156
v9.2.0157
v9.2.0158
v9.2.0159
v9.2.0160
v9.2.0161
v9.2.0162
v9.2.0163
v9.2.0164
v9.2.0165
v9.2.0166
v9.2.0167
v9.2.0168
v9.2.0169
v9.2.0170
v9.2.0171
v9.2.0172
v9.2.0173
v9.2.0174
v9.2.0175
v9.2.0176
v9.2.0177
v9.2.0178
v9.2.0179
v9.2.0180
v9.2.0181
v9.2.0182
v9.2.0183
v9.2.0184
v9.2.0185
v9.2.0186
v9.2.0187
v9.2.0188
v9.2.0189
v9.2.0190
v9.2.0191
v9.2.0192
v9.2.0193
v9.2.0194
v9.2.0195
v9.2.0196
v9.2.0197
v9.2.0198
v9.2.0199
v9.2.0200
v9.2.0201
v9.2.0202
v9.2.0203
v9.2.0204
v9.2.0205
v9.2.0206
v9.2.0207
v9.2.0208
v9.2.0209
v9.2.0210
v9.2.0211
v9.2.0212
v9.2.0213
v9.2.0214
v9.2.0215
v9.2.0216
v9.2.0217
v9.2.0218
v9.2.0219
v9.2.0220
v9.2.0221
v9.2.0222
v9.2.0223
v9.2.0224
v9.2.0225
v9.2.0226
v9.2.0227
v9.2.0228
v9.2.0229
v9.2.0230
v9.2.0231
v9.2.0232
v9.2.0233
v9.2.0234
v9.2.0235
v9.2.0236
v9.2.0237
v9.2.0238
v9.2.0239
v9.2.0240
v9.2.0241
v9.2.0242
v9.2.0243
v9.2.0244
v9.2.0245
v9.2.0246
v9.2.0247
v9.2.0248
v9.2.0249
v9.2.0250
v9.2.0251
v9.2.0252
v9.2.0253
v9.2.0254
v9.2.0255
v9.2.0256
v9.2.0257
v9.2.0258
v9.2.0259
v9.2.0260
v9.2.0261
v9.2.0262
v9.2.0263
v9.2.0264
v9.2.0265
v9.2.0266
v9.2.0267
v9.2.0268
v9.2.0269
v9.2.0270
v9.2.0271

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34714.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "305234367409310373871146883469209415473",
                "171867100546767150496274974225539412000",
                "77658638993862076272880748419069940419",
                "338313079759188839250143402320403528493"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34714-685ed943",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459",
        "target": {
            "file": "src/optiondefs.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "324383238003256014553984913710635266208",
                "166052526757617232663400215967440322307",
                "334609158160097800215207191211682620787"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34714-aa584243",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459",
        "target": {
            "file": "src/autocmd.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "146200493773228420153804765641940418619",
                "111242980648154476810089975573251393293",
                "110307608700122551468148191508597119882",
                "195503808517675034237851387306850988560"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34714-b65c0b48",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459",
        "target": {
            "file": "src/version.c"
        }
    }
]
vanir_signatures_modified 
"2026-09-03T08:05:37Z"