Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept(), causing descriptors to overflow fdset structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-121"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73070.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73070.json"
[
{
"target": {
"function": "channel_select_setup",
"file": "src/channel.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-712ac08c",
"signature_version": "v1",
"digest": {
"length": 691.0,
"function_hash": "298471314337379111008744927566211848161"
},
"signature_type": "Function"
},
{
"target": {
"file": "src/version.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-739f9007",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146200493773228420153804765641940418619",
"3961971518578718233728620780318514",
"12075496184436988406115679710997711077",
"70549688629272946239732189753139687821"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "src/socketserver.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-810687cd",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"113395843997339089065348720532964582057",
"30836306813356530863924976521982607673",
"130257974598269041032950666130465998718",
"289539226395635890959423121391916624757",
"316732130582561897940797092199841634442",
"167750100356845978178992142009711679318",
"16787181494239473446950974794793354930",
"241804144192415154587898166183510186191",
"157864529496072478028515156061212896742",
"318085661258325023406870813998590176637",
"172909982680885756288299361442835962026",
"193393074308424798020161736426841516883",
"32367047978463642655745112994591169895",
"337932618109275015479951034820502396454",
"136034649872336984316383310378536114390",
"176197714617887221674935959192255621739",
"152575063898567494252596953467174676881",
"249105800118801052324099083707862080436",
"255293008164373638190486573516303267483",
"88121136517177204011078496441957900173",
"58463821328732157872366678719915846230",
"162843499187415396788915565034854375575",
"328969171125219650952221648422364481204",
"170596573142666015256811475782148227932",
"179928478029308272777206839062199210463",
"83375297880088747214563798899898946449",
"273775834516127954448812785939816330465",
"123479936298385871090229486058226282994"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "src/channel.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-8f985bd7",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"96265917058158424372438729074492942336",
"19162746664467410404222839192543611845",
"261759564620673187480248573511028015987",
"271364783410798058832894972311972247379",
"188839756114221298725984240420910765312",
"270786608319513083802928976132205961530",
"130171176272324928847122615986073587317",
"136959533429523396701319998942298019403",
"333074141710635353878506192750459148821",
"213903345752185058963165358927891649095",
"339846783934875090299917415844998319470",
"284946812381421999757851160339890334604",
"111012152268989513712456366310444206306",
"58660371148098293621165523141377791405",
"102808757322153737777189005344881752609",
"206098164398764370545074245268946702761",
"24945339489717487861811949235929125946",
"174595403886599834351093930686902684243",
"237417351529563112753847347032466812648",
"119647816845588869290253639425553123914"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "src/os_unix.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-993508e0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"240388057872009485837231272697425725723",
"37437026734698742007098931216599794663",
"140919458591433701499613979973136257128",
"267939697624468562750218369367980837491"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "socketserver_wait",
"file": "src/socketserver.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-a2b83bf9",
"signature_version": "v1",
"digest": {
"length": 2854.0,
"function_hash": "272074741005067136764118318938099576481"
},
"signature_type": "Function"
},
{
"target": {
"function": "socketserver_accept",
"file": "src/socketserver.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-b9fc4c72",
"signature_version": "v1",
"digest": {
"length": 467.0,
"function_hash": "290821407368758377616786241420585888380"
},
"signature_type": "Function"
},
{
"target": {
"function": "socketserver_client_close",
"file": "src/socketserver.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-c396114c",
"signature_version": "v1",
"digest": {
"length": 361.0,
"function_hash": "142080103634831376032195670508220082228"
},
"signature_type": "Function"
},
{
"target": {
"file": "src/vim.h"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-c81a294f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"262316417916715952702711805515970168430",
"46377863294966406024471558275829124264",
"301963902696651370078924416453090319376"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "channel_fill_wfds",
"file": "src/channel.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-e22a2d80",
"signature_version": "v1",
"digest": {
"length": 354.0,
"function_hash": "286072954443476783918415381079694216679"
},
"signature_type": "Function"
},
{
"target": {
"function": "channel_wait",
"file": "src/channel.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-ee717d02",
"signature_version": "v1",
"digest": {
"length": 1618.0,
"function_hash": "62307628746044103114300480455939461093"
},
"signature_type": "Function"
},
{
"target": {
"function": "channel_select_check",
"file": "src/channel.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
"id": "CVE-2026-73070-ff3a626a",
"signature_version": "v1",
"digest": {
"length": 991.0,
"function_hash": "308851859773248669577776233771603306264"
},
"signature_type": "Function"
}
]
"2026-08-13T08:22:35Z"