{"id":"CLSA-2026-1779356802","summary":"vim: Fix of 21 CVEs","details":"- CVE-2022-0572: heap overflow on vcol-overflow in :retab (upstream vim 8.2.4359)\n- CVE-2022-0368: illegal memory access when undo makes Visual area invalid (upstream vim 8.2.4217)\n- CVE-2022-0685: crash on multi-byte char in unix_expandpath() (upstream vim 8.2.4418)\n- CVE-2022-2125: heap overflow in get_lisp_indent() (upstream vim 8.2.5122)\n- CVE-2022-2183: reading past end-of-line in lisp indenting (upstream vim 8.2.5151)\n- CVE-2022-2124: reading past end-of-line in current_quote() (upstream vim 8.2.5120)\n- CVE-2022-2344: heap overflow in ins_compl_add() (upstream vim 9.0.0046)\n- CVE-2022-3256: use-after-free in movemark() when autocmd changes mark (upstream vim 9.0.0530)\n- CVE-2023-4752: heap use-after-free in ins_compl_get_exp() (upstream vim 9.0.1858)\n- CVE-2022-2126: spell-suggest read past bad word (upstream vim 8.2.5123)\n- CVE-2022-2946: use-after-free in do_tag() when tagfunc invalidates tagstack (upstream vim 9.0.0246)\n- CVE-2022-1720: OOB read in get_visual_text() (upstream vim 8.2.4956)\n- CVE-2022-3234: OOB write in op_replace() (upstream vim 9.0.0483)\n- CVE-2023-0433: same_leader() read past end-of-line on short comment line (upstream vim 9.0.1225)\n- CVE-2023-4781: heap-buffer-overflow in vim_regsub_both() via nmatch underflow in :substitute, plus textlock guard in win_exchange() (upstream vim 9.0.1873)\n- CVE-2022-0351: crash on deeply nested expression (upstream vim 8.2.4206)\n- CVE-2022-2175: new_cmdpos leak across register insertion in getcmdline() (upstream vim 8.2.5148)\n- CVE-2026-39881: netbeans command injection via crafted sign/highlight identifier + special-keys (upstream vim 9.2.0316)\n- CVE-2021-4166: heap-buffer-overflow when clearing the argument list while it is being used (upstream vim 8.2.3884, with 8.2.2421 + 8.2.2463 prereqs for arglist_locked plumbing)\n- CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)\n- CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)","modified":"2026-05-27T11:33:29.502415974Z","published":"2026-05-21T09:46:46Z","upstream":["CVE-2021-4166","CVE-2022-0351","CVE-2022-0368","CVE-2022-0572","CVE-2022-0685","CVE-2022-1720","CVE-2022-2124","CVE-2022-2125","CVE-2022-2126","CVE-2022-2175","CVE-2022-2183","CVE-2022-2343","CVE-2022-2344","CVE-2022-2946","CVE-2022-3234","CVE-2022-3256","CVE-2022-3296","CVE-2023-0433","CVE-2023-4752","CVE-2023-4781","CVE-2026-39881"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1779356802.html"}],"affected":[{"package":{"name":"vim-X11","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/vim-X11?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1779356802.json"}},{"package":{"name":"vim-common","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/vim-common?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1779356802.json"}},{"package":{"name":"vim-enhanced","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/vim-enhanced?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1779356802.json"}},{"package":{"name":"vim-filesystem","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/vim-filesystem?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1779356802.json"}},{"package":{"name":"vim-minimal","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/vim-minimal?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1779356802.json"}}],"schema_version":"1.7.5"}