Executive brief
Vim is a widely-used command-line text editor that can operate as a socket server for remote connections. Prior to version 9.2.0842, the socket server accepts an unbounded number of client connections, which can overflow internal data structures and allow a local attacker to corrupt memory or crash the server. This could disrupt users relying on Vim's server functionality or enable privilege escalation on shared systems.
Technical details
The vulnerability is a stack buffer overflow in Vim's socket server backend (src/socketserver.c). The socketserver_accept() function accepts unlimited client connections without bounds checking, causing file descriptors to overflow fixed-size fd_set structures in src/channel.c and pollfd arrays in src/os_unix.c. A local process with the ability to connect to the server socket can trigger this overflow to corrupt stack memory or terminate the Vim server. The attack requires local network or socket access and no authentication. The fix, implemented in version 9.2.0842, caps the number of accepted socket connections to prevent descriptor overflow.
Affected products
- Vim Vim prior to 9.2.0842
Timeline
- 2026-08-11: disclosed: CVE-2026-73070 published
- 2026-07-23: patched: Fix released in version 9.2.0842