CVE-2026-57454

Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property data. When Vim restores or displays such a line it converts the offset into a pointer and reads the virtual text without bounds checking, causing an out-of-bounds read that can crash Vim or disclose adjacent heap memory. This vulnerability is fixed in 9.2.0679.

• CWE-125

• https://github.com/vim/vim/commit/b3faeecc976d3031d7c0675623516ec60c30f949Patch
• https://github.com/vim/vim/releases/tag/v9.2.0679Product
• https://github.com/vim/vim/security/advisories/GHSA-ww8h-47xp-hp4wVendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57445Gardens v2 is a modular governance framework that enables co…8.7
• CVE-2026-57449Actual is a local-first personal finance tool. Prior to 26.7…7.1
• CVE-2026-5745A flaw was found in libarchive. A NULL pointer dereference v…5.5
• CVE-2026-57451Vim is an open source, command line text editor. Prior to 9.…6.1
• CVE-2026-57452Vim is an open source, command line text editor. Prior to 9.…5.5
• CVE-2026-57453Vim is an open source, command line text editor. From 9.1.17…7.3
• CVE-2026-57455Vim is an open source, command line text editor. Prior to 9.…7.8
• CVE-2026-57456Vim is an open source, command line text editor. Prior to 9.…7.8
• CVE-2026-57469Nozomi Networks Labs identified a CWE-352: Cross-Site Reques…5.1
• CVE-2026-5747An out-of-bounds write issue in the virtio PCI transport in …8.7
• CVE-2026-57471Nozomi Networks Labs identified a CWE-22: Improper Limitatio…6.8
• CVE-2026-57472Nozomi Networks Labs identified a CWE-22: Improper Limitatio…6.9