PT-2026-52477 · Vim · Vim

Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-57452

Mitre

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt04! or VimCrypt05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.

Correção

Out of bounds Read

Integer Underflow

Enumeração de Fraquezas

CWE-125

CWE-191

Identificadores relacionados

CVE-2026-57452

Produtos afetados

Vim

Referências · 4

• https://github.com/vim/vim/commit/c8777cec25dcfae89c42e9aff51af61f71c5745f · Nota
• https://github.com/vim/vim/releases/tag/v9.2.0671 · Nota
• https://github.com/vim/vim/security/advisories/GHSA-c4j9-wr9j-4486 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57452 · Nota de Segurança