PT-2026-22421 · Vim+3 · Vim+3

Ehdgks0627 · Published 2026-02-27 · Updated 2026-05-24 · CVE-2026-28422

Positive Technologies (AI Summary)

CVSS v3.1

2.2

Low

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0078

Description Vim is an open source, command line text editor. A stack-based buffer overflow occurs in the build stl str hl() function when rendering a statusline with a multi-byte fill character on a very wide terminal. This can potentially impact the integrity of protected information.

Recommendations Versions prior to 9.2.0078 should be updated to version 9.2.0078 or later.

Exploit

Fix

DoS

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

AZL-78512

BDU:2026-02587

CVE-2026-28422

ECHO-F134-6EF2-2906

GHSA-GMQX-PRF2-8MWF

MGASA-2026-0049

OESA-2026-1565

SUSE-SU-2026:0910-1

SUSE-SU-2026:1051-1

SUSE-SU-2026:1095-1

USN-8101-1

Affected Products

Linuxmint

Red Os

Ubuntu

Vim

References · 73

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28422.json · Exploit
• https://github.com/vim/vim/security/advisories/GHSA-gmqx-prf2-8mwf · Vendor Advisory
• https://github.com/vim/vim/commit/4e5b9e31cb7484ad156f · Patch
• https://ubuntu.com/security/CVE-2026-26269 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28422 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-28419 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-28418 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-28422 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28422 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0049.html · Security Note
• https://ubuntu.com/security/CVE-2026-28418 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28420 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1051-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28417 · Security Note