Executive brief
Vim is a widely used open-source text editor. A vulnerability exists where opening a specially crafted, encrypted file can cause the application to crash. This occurs when the file uses specific encryption methods and has an unexpectedly short content body, leading to a denial of service for the user.
Technical details
An integer underflow vulnerability exists in Vim's handling of libsodium-encrypted files (VimCrypt~04! and VimCrypt~05!). The function crypt_get_header_len() fails to validate that the encrypted body length is at least as large as the libsodium secretstream header. In crypt_sodium_buffer_decode(), a subtraction operation on a size_t variable underflows when the body is too short, resulting in a very large length value being passed to crypto_secretstream_xchacha20poly1305_pull(). This causes an out-of-bounds read and a subsequent application crash. Exploitation requires the +sodium feature to be enabled and user interaction to open a crafted file and provide a decryption key. The issue is fixed in version 9.2.0671.
Affected products
- Vim Vim < 9.2.0671
Timeline
- 2026-06-17: disclosed: Date listed in security advisory description.
- 2026-06-18: patched: Patch 9.2.0671 released.
- 2026-06-25: advisory: NVD and GitHub advisory published.