PT-2026-22420 · Vim+4 · Vim+4

Ehdgks0627 · Published 2026-02-27 · Updated 2026-05-24 · CVE-2026-28421

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0077

Description Vim is an open-source, command-line text editor. Versions prior to 9.2.0077 contain a heap-buffer-overflow and a segmentation fault (SEGV) within the swap file recovery logic. These issues are triggered by unvalidated fields read from crafted pointer blocks within a swap file.

Recommendations Versions prior to 9.2.0077 should be updated to version 9.2.0077 or later.

Exploit

Fix

DoS

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-20

CWE-122

Related Identifiers

ALSA-2026:6915

ALSA-2026:7711

ALSA-2026:8259

AZL-78500

BDU:2026-02591

CVE-2026-28421

ECHO-6C94-1F29-8634

GHSA-R2GW-2X48-JJ5P

MGASA-2026-0049

OESA-2026-1565

RHSA-2026:6502

RHSA-2026:6539

RHSA-2026:6540

RHSA-2026:6617

RHSA-2026:6619

RHSA-2026:6620

RHSA-2026:6729

RHSA-2026:6730

RHSA-2026:6731

RHSA-2026:6736

RHSA-2026:6915

RHSA-2026:7711

RHSA-2026:8259

SUSE-SU-2026:0910-1

SUSE-SU-2026:1051-1

SUSE-SU-2026:1095-1

USN-8101-1

Affected Products

Linuxmint

Red Os

Rocky Linux

Ubuntu

Vim

References · 94

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28421.json · Exploit
• https://github.com/vim/vim/security/advisories/GHSA-r2gw-2x48-jj5p · Vendor Advisory
• https://github.com/vim/vim/commit/65c1a143c331c886dc28 · Patch
• https://errata.almalinux.org/8/ALSA-2026-6915.html · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-8259.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02591 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-6617.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28417 · Security Note
• https://ubuntu.com/security/CVE-2026-26269 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0910-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25749 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28418 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-6915.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1565 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28417 · Vendor Advisory