CVE-2026-28418 Details

A heap-based buffer overflow vulnerability allowing out-of-bounds reads has been identified in Vim versions prior to 9.2.0074. This issue arises in the Emacs-style tags file parsing logic, specifically within the 'emacs_tags_new_filename()' function. When Vim processes a malformed tags file, it can be manipulated into reading up to 7 bytes beyond the allocated memory limit. The vulnerability occurs because the code incorrectly assumes that a comma delimiter has been found, leading to unauthorized access of memory immediately after the buffer boundary. This out-of-bounds read can cause Vim to crash, creating a denial-of-service condition.

Users can upgrade to Vim version 9.2.0074 or later, where this vulnerability has been fixed.