CVE-2026-28422 Details
Description
Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.
A stack-buffer overflow vulnerability has been identified in Vim versions prior to 9.2.0078. The issue occurs in the function 'build_stl_str_hl()' when a multi-byte fill character is used in the statusline on a very wide terminal. Vim's statusline rendering process uses a fixed-size stack buffer of 4096 bytes. When a multi-byte character, such as U+2500, is employed as a fill character, it can exceed the buffer's capacity on terminals wider than approximately 1365 columns. This discrepancy leads to a stack overflow of up to 1904 bytes, as the byte-count surpasses the buffer limit while the cell-count check still passes.
Users can update to Vim version 9.2.0078 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/02/27/11 | CVE | Mailing ListPatchThird Party Advisory |
| https://github.com/vim/vim/commit/4e5b9e31cb7484ad156f | [email protected] | Patch |
| https://github.com/vim/vim/releases/tag/v9.2.0078 | [email protected] | Product |
| https://github.com/vim/vim/security/advisories/GHSA-gmqx-prf2-8mwf | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vim vim | < 9.2.0078 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 4, 2026 | Initial Analysis | [email protected] |
| Feb 28, 2026 | CVE Modified | CVE |
| Feb 27, 2026 | New CVE Received | [email protected] |