CVE-2026-73071

Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.

• CWE-416

• https://github.com/vim/vim/commit/f8126294a526aa80c5123eb3079e325daee9ec75
• https://github.com/vim/vim/releases/tag/v9.2.0844
• https://github.com/vim/vim/security/advisories/GHSA-69ch-22ch-r887

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73066Tesseract is an open source OCR engine. Prior to 5.5.3, a cr…6.8
• CVE-2026-73067Tesseract is an open source OCR engine. Prior to 5.5.3, a cr…6.7
• CVE-2026-73068ToolJet is the open-source foundation am AI-native platform …5.9
• CVE-2026-73069Twenty is an open-source CRM (customer relationship manageme…9.1
• CVE-2026-7307A flaw was found in Keycloak. A remote, unauthenticated atta…7.5
• CVE-2026-73070Vim is an open source, command line text editor. Prior to 9.…6.8
• CVE-2026-73072Vim is an open source, command line text editor. Prior to 9.…8.5
• CVE-2026-73074Vim is an open source, command line text editor. Prior to 9.…7.1
• CVE-2026-73075Vim is an open source, command line text editor. From 9.2.04…4.6
• CVE-2026-73076Vim is an open source, command line text editor. Prior to 9.…8.4
• CVE-2026-73077Vim is an open source, command line text editor. Prior to 9.…8.4
• CVE-2026-73078Vim is an open source, command line text editor. Prior to 9.…8.6