Executive brief
Vim is a widely used open-source text editor. A vulnerability in its regular expression engine allows an attacker to crash the application by providing a specially crafted search pattern. This could lead to a denial-of-service or potentially be used as part of a more complex attack against users who open malicious files or use untrusted plugins.
Technical details
A NULL pointer dereference exists in Vim's NFA regex engine within the nfa_max_width() function. When the compiler encounters a collection containing a combining Unicode character as a range endpoint (e.g., [0-0\u05bb]), it incorrectly emits composing bytes as separate NFA states, corrupting the postfix stack. This results in an NFA_START_COLL state with a NULL out1 pointer; subsequent traversal for look-behind assertions dereferences this pointer without a check, causing a segmentation fault. The vulnerability requires the attacker to supply a malicious regex pattern, typically via a file, plugin, or command-line argument. The issue was introduced in version 9.1.0011 and is fixed in version 9.2.0137.
Affected products
- Vim Vim 9.1.0011 to 9.2.0137
Timeline
- 2026-03-11: patched: Fixed in version 9.2.0137
- 2026-03-12: disclosed: Public disclosure of CVE-2026-32249