Is CVE-2026-73076 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73076 being exploited in the wild.

How severe is CVE-2026-73076?

Informational severity, with a CVSS score of 6.3, published 11 August 2026.

Is there a fix for CVE-2026-73076?

A patch was published on 2026-07-24: version 9.2.0847 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73076 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-73076?

Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73076: Vim vimball arbitrary command execution via .VimballRecord

CVE-2026-73076 · Severity: info · CVSS 6.3 · Published 2026-08-11

Vim is a widely-used text editor that includes a plugin system for installing extensions via vimball archives. The vimball installer maintains a record file listing files to remove on uninstall, and prior to version 9.2.0847, a crafted archive could inject arbitrary commands into this record file, which would later execute with the user's privileges when any vimball operation reads the record. This allows an attacker who controls a vimball to plant persistent commands that execute in future vimball operations—even after the original malicious archive is removed.

Technologies: Vim. Vendors: Vim.

Quick answers

Is CVE-2026-73076 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73076 being exploited in the wild.
How severe is CVE-2026-73076?: Informational severity, with a CVSS score of 6.3, published 11 August 2026.
Which products and versions are affected?: Vim prior to 9.2.0847.
Is there a fix for CVE-2026-73076?: A patch was published on 2026-07-24: version 9.2.0847 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73076 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-73076?: Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in runtime/autoload/vimball.vim, which maintains a .VimballRecord file containing Ex commands to undo prior vimball installations. While the plugin blocked member names containing characters that could inject commands (bars, quotes, closing parentheses), it did not block a member named .VimballRecord itself. An attacker can craft a vimball archive containing a .VimballRecord member with malicious Ex commands; when extracted, this overwrites the legitimate record file with attacker-controlled content. Later, when vimball#RmVimball() processes any vimball operation, it executes those stored commands without validation via exe, allowing arbitrary command execution including OS commands through :!. The vulnerability requires the victim to extract a malicious vimball archive, but does not require execution during extraction—commands persist in the record and fire on subsequent unrelated vimball operations. The fix (9.2.0847) forbids extraction of members named .VimballRecord and validates record entries to contain only expected deletion commands.

Affected products

Vim Vim prior to 9.2.0847

Timeline

2026-07-24: disclosed
2026-07-24: patched: version 9.2.0847
2026-08-11: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.