Vim is an open source, command line text editor. Prior to version 9.2.0565, the updatesnapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERMMAXCHARSPER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.
{
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52859.json",
"cwe_ids": [
"CWE-125"
]
}{
"cpe": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*",
"source": [
"AFFECTED_FIELD",
"CPE_RANGE",
"REFERENCES"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "9.2.0565"
}
]
}[
{
"signature_type": "Function",
"target": {
"file": "src/terminal.c",
"function": "update_snapshot"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19",
"signature_version": "v1",
"id": "CVE-2026-52859-65aed594",
"digest": {
"length": 2870.0,
"function_hash": "35384550909836653792339041986686362211"
}
},
{
"signature_type": "Line",
"target": {
"file": "src/terminal.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19",
"signature_version": "v1",
"id": "CVE-2026-52859-6ab07743",
"digest": {
"line_hashes": [
"20344699351619320102748123166256114341",
"292554889023750465615634413421624588684",
"21756054422888712486525188408495287810",
"56918785341602379253689451988571146812"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "src/version.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19",
"signature_version": "v1",
"id": "CVE-2026-52859-ea2a4c40",
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"310176338235120338945554724910971105350",
"164015062191510565693238532470387356282",
"6587242155241126869375765817058241532"
],
"threshold": 0.9
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52859.json"
"2026-07-30T14:08:58Z"