DEBIAN-CVE-2026-32249

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-32249

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32249.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-32249

Upstream

CVE-2026-32249

Published

2026-03-12T20:16:05Z

Modified

2026-09-14T17:03:06Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.

References

https://security-tracker.debian.org/tracker/CVE-2026-32249

Affected packages

Debian:13 / vim

Package

Name: vim
Purl: pkg:deb/debian/vim?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2:9.*

2:9.1.1230-2

2:9.1.1385-1

2:9.1.1766-1

2:9.1.1829-1

2:9.1.1846-1

2:9.1.1882-1

2:9.1.2103-1

2:9.1.2141-1

2:9.2.0119-1

2:9.2.0136-1

2:9.2.0218-1

2:9.2.0315-1

2:9.2.0338-1

2:9.2.0355-1

2:9.2.0428-1

2:9.2.0461-1

2:9.2.0524-1

2:9.2.0782-1

2:9.2.0858-1

Ecosystem specific

{
    "urgency":  "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32249.json"

Debian:14 / vim