Is CVE-2026-57452 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57452 being exploited in the wild.

How severe is CVE-2026-57452?

Medium severity, with a CVSS score of 5.5, published 25 June 2026.

Is there a fix for CVE-2026-57452?

A patch was published on 2026-06-18: Patch 9.2.0671 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57452 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-57452?

Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57452: Vim out-of-bounds read in libsodium-encrypted file parsing

CVE-2026-57452 · Severity: medium · CVSS 5.5 · Published 2026-06-25

Vim is a widely used open-source text editor. A vulnerability exists where opening a specially crafted, encrypted file can cause the application to crash. This occurs when the file uses specific encryption methods and has an unexpectedly short content body, leading to a denial of service for the user.

Technologies: Vim. Vendors: Vim.

Quick answers

Is CVE-2026-57452 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57452 being exploited in the wild.
How severe is CVE-2026-57452?: Medium severity, with a CVSS score of 5.5, published 25 June 2026.
Which products and versions are affected?: Vim < 9.2.0671.
Is there a fix for CVE-2026-57452?: A patch was published on 2026-06-18: Patch 9.2.0671 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57452 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-57452?: Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow vulnerability exists in Vim's handling of libsodium-encrypted files (VimCrypt~04! and VimCrypt~05!). The function crypt_get_header_len() fails to validate that the encrypted body length is at least as large as the libsodium secretstream header. In crypt_sodium_buffer_decode(), a subtraction operation on a size_t variable underflows when the body is too short, resulting in a very large length value being passed to crypto_secretstream_xchacha20poly1305_pull(). This causes an out-of-bounds read and a subsequent application crash. Exploitation requires the +sodium feature to be enabled and user interaction to open a crafted file and provide a decryption key. The issue is fixed in version 9.2.0671.

Affected products

Vim Vim < 9.2.0671

Timeline

2026-06-17: disclosed: Date listed in security advisory description.
2026-06-18: patched: Patch 9.2.0671 released.
2026-06-25: advisory: NVD and GitHub advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.