PT-2026-29480 · Vim+4 · Vim+4

Avishayy · Published 2026-03-31 · Updated 2026-05-24 · CVE-2026-34982

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0276

Description Vim is susceptible to remote code execution through maliciously crafted "modelines" that can bypass sandboxes. This allows for the execution of commands.

Recommendations Update to version 9.2.0276 or add "set nomodeline" to your vimrc.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALSA-2026:11389

ALSA-2026:11509

ALSA-2026:11510

ALSA-2026:19073

ALSA-2026:19224

BDU:2026-05722

CVE-2026-34982

ECHO-2564-0801-C3CC

MGASA-2026-0083

OESA-2026-1922

OPENSUSE-SU-2026:10652-1

OPENSUSE-SU-2026:20540-1

RHSA-2026:11389

RHSA-2026:11509

RHSA-2026:11510

RHSA-2026:19073

RHSA-2026:19224

SUSE-SU-2026:1347-1

SUSE-SU-2026:1387-1

SUSE-SU-2026:1607-1

SUSE-SU-2026:21118-1

SUSE-SU-2026:21124-1

SUSE-SU-2026:21134-1

SUSE-SU-2026:21197-1

USN-8171-1

Affected Products

Linuxmint

Red Os

Rocky Linux

Ubuntu

Vim

References · 82

• https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9 · Vendor Advisory
• https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34982 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1347-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-34982 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1607-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-11509.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34982 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0083.html · Security Note
• https://ubuntu.com/security/CVE-2026-33412 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34982 · Security Note
• https://errata.almalinux.org/9/ALSA-2026-19224.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-8171-1 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-11510.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1922 · Vendor Advisory