CVE-2026-34714

HOCH 8.6CVE-2026-34714 · Published 30/03/2026 · updated 01/09/2026

Kurz gesagt

CVE-2026-34714 ist eine Schwachstelle (HOCH (CVSS 8.6)) in vim (vim).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.60%, höher als bei 48.6% aller Schwachstellen.
Abhilfe: auf 9.2.0272 oder neuer aktualisieren.

Package	Affected versions	Patched versions
vim vim	`≥ 9.1.1390, < 9.2.0272`	`9.2.0272`

Description

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

References

vim/vim commit 664701e · Patch
vim/vim release v9.2.0272 · Release Notes
vim/vim security advisory · Vendor Advisory
openwall.com/lists/oss-security/2026/03/30/3 · Mailing List
openwall.com/lists/oss-security/2026/04/02/4 · Issue Tracking
openwall.com/lists/oss-security/2026/04/02/5 · Mailing List
openwall.com/lists/oss-security/2026/04/03/6 · Mailing List
access.redhat.com/security/cve/CVE-2026-34714
bugzilla.redhat.com/show_bug.cgi
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34714.json

Weitere Schwachstellen in vim

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

vim

≥ 9.1.1390, < 9.2.0272

9.2.0272

Weitere Schwachstellen in vim

Alle anzeigen →