Quick answers
- Is CVE-2026-57454 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-57454 being exploited in the wild.
- How severe is CVE-2026-57454?
- Informational severity, with a CVSS score of 6.8, published 25 June 2026.
- Which products and versions are affected?
- Vim >= 9.2.0320, < 9.2.0679.
- Is there a fix for CVE-2026-57454?
- A patch was published on 2026-06-20: Fixed in Vim patch 9.2.0679 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-57454 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-57454?
- Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in Vim's handling of text properties stored in undo and swap files. Since patch 9.2.0320, text properties are stored inline; however, the application failed to validate that the 'tp_text_offset' and 'tp_len' for virtual-text properties remained within the bounds of the property data buffer. When Vim restores or displays a line from a malicious file, it converts the untrusted offset into a pointer without bounds checking. An attacker can exploit this by providing a crafted file that, when opened or recovered by a user, causes a heap-based out-of-bounds read. This can result in a denial of service (crash) or the disclosure of adjacent heap memory. The issue is resolved in version 9.2.0679.
Affected products
- Vim Vim >= 9.2.0320, < 9.2.0679
Timeline
- 2026-06-20: advisory: GitHub Security Advisory published
- 2026-06-20: patched: Fixed in Vim patch 9.2.0679
- 2026-06-25: disclosed: NVD publication date