Is CVE-2026-73071 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73071 being exploited in the wild.

How severe is CVE-2026-73071?

Low severity, with a CVSS score of 3.3, published 11 August 2026.

Is there a fix for CVE-2026-73071?

A patch was published on 2026-07-24: Version 9.2.0844 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73071 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73071?

Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73071: Vim use-after-free in JSON decoder

CVE-2026-73071 · Severity: low · CVSS 3.3 · Published 2026-08-11

Vim is a widely-used command-line text editor that supports network communication through sockets. A flaw in its JSON parsing code allows an attacker to read freed memory by sending a specially crafted JSON string over the network, potentially exposing sensitive data that was recently freed from memory.

Technologies: Vim. Vendors: Vim.

Quick answers

Is CVE-2026-73071 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73071 being exploited in the wild.
How severe is CVE-2026-73071?: Low severity, with a CVSS score of 3.3, published 11 August 2026.
Which products and versions are affected?: Vim 9.2.0511 to 9.2.0843.
Is there a fix for CVE-2026-73071?: A patch was published on 2026-07-24: Version 9.2.0844 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73071 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73071?: Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a use-after-free in json_decode_item() (src/json.c), where a cached pointer to the read buffer can become stale after json_decode_string() calls channel_fill() to refill and free the current buffer. When an invalid JSON string spans multiple buffer refills (e.g., with an invalid \u escape sequence), the error handler passes the dangling pointer to semsg(), causing a read of freed memory. This is reachable pre-authentication through Vim's socket server. The bug affects versions 9.2.0511 through 9.2.0843 and was fixed in version 9.2.0844 by using the current reader's position instead of the cached pointer.

Affected products

Vim Vim 9.2.0511 to 9.2.0843

Timeline

2026-08-11: disclosed
2026-07-24: patched: Version 9.2.0844 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.