CVE-2026-52859 Details

A vulnerability allowing an out-of-bounds read has been identified in Vim versions prior to 9.2.0565. The issue arises in the 'update_snapshot()' function within 'src/terminal.c', where the function copies the visible terminal screen into the scrollback buffer. The vulnerability occurs because the function iterates over the 'chars[]' array of each screen cell without an upper limit, only stopping at a NUL terminator. When a cell fills all six character slots (a base character plus five combining marks), the array is returned without a terminating NUL, leading the function to read past the end of the fixed-size array. This out-of-bounds read appends attacker-controlled values to a buffer designed for only six characters, causing a crash. The vulnerability can be triggered by a program outputting a short byte sequence in a ':terminal' window, without the need for Vim scripting.

Users can update to Vim version 9.2.0565 or later, where this vulnerability has been fixed.