CVE-2026-34714 Details
Description
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
A vulnerability in Vim versions prior to 9.2.0272 allows arbitrary code execution through the `tabpanel` option, which lacks proper modeline security. When a crafted file is opened, the absence of the `P_MLE` flag on `tabpanel` enables injection of expression strings that are executed after the file is opened, bypassing sandbox restrictions. This issue arises because `autocmd_add()` does not include a security check, allowing registered commands to run with the user's privileges.
Users can update to Vim version 9.2.0272 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-34714 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2453139 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34714.json | redhat-SADP | |
| http://www.openwall.com/lists/oss-security/2026/04/02/4 | CVE | Issue TrackingMailing List |
| http://www.openwall.com/lists/oss-security/2026/04/02/5 | CVE | Mailing List |
| http://www.openwall.com/lists/oss-security/2026/04/03/6 | CVE | Mailing List |
| https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459 | [email protected] | Patch |
| https://github.com/vim/vim/releases/tag/v9.2.0272 | [email protected] | Release Notes |
| https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh | [email protected] | Vendor Advisory |
| https://www.openwall.com/lists/oss-security/2026/03/30/3 | [email protected] | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| vim vim | >= 9.1.1390, < 9.2.0272 |
CPE
Remediation
| |
Change History
13 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 1, 2026 | CVE Modified | CVE |
| Sep 1, 2026 | CVE Modified | [email protected] |
| Sep 1, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 25, 2026 | Modified Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 3, 2026 | CVE Modified | CVE |
| Apr 2, 2026 | CVE Modified | CVE |
| Apr 2, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | CVE Modified | CVE |
| Mar 30, 2026 | New CVE Received | [email protected] |