← All notices | Source (USN-8657-1) | Text version

QSN-8657-1: Vim vulnerabilities

August 20, 2026

Summary

Several security issues were fixed in Vim.

Details

It was discovered that Vim incorrectly handled memory when decoding certain JSON input. An attacker could possibly use this issue to cause Vim to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-73071)

Yazan Balawneh discovered that Vim incorrectly handled memory when opening certain spell files. An attacker could possibly use this issue to cause Vim to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-73072)

It was discovered that Vim incorrectly handled memory when processing certain files with a large number of text properties. An attacker could possibly use this issue to cause Vim to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-73074)

It was discovered that Vim incorrectly handled certain vimball files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-73076)

It was discovered that Vim incorrectly handled shell arguments during keyword lookups. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-73077)

David Carliez discovered that Vim incorrectly handled certain directory paths when constructing netrw menus. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-73078)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSvimInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.9.1.001Ubuntu 22.04 LTSvim-commonInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.9.1.001Ubuntu 22.04 LTSvim-runtimeInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.9.1.001Ubuntu 22.04 LTSvim-tinyInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.9.1.001Ubuntu 22.04 LTSxxdInternally-facing2:8.2.3995-1ubuntu2.182:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.9.0.464Ubuntu 22.04 LTSvimInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.9.0.464Ubuntu 22.04 LTSvim-commonInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.9.0.464Ubuntu 22.04 LTSvim-runtimeInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.9.0.464Ubuntu 22.04 LTSvim-tinyInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.9.0.464Ubuntu 22.04 LTSxxdInternally-facing2:8.2.3995-1ubuntu2.182:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSvimInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.8.6.015Ubuntu 22.04 LTSvim-commonInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.8.6.015Ubuntu 22.04 LTSvim-runtimeInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.8.6.015Ubuntu 22.04 LTSvim-tinyInternally-facing2:8.2.3995-1ubuntu2.362:8.2.3995-1ubuntu2.35Fixed in this release
6.8.6.015Ubuntu 22.04 LTSxxdInternally-facing2:8.2.3995-1ubuntu2.182:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSvimInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSvim-commonInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSvim-runtimeInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSvim-tinyInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSxxdInternally-facing2:8.2.3995-1ubuntu2.182:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSvimInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSvim-commonInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSvim-runtimeInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSvim-tinyInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSxxdInternally-facing2:8.2.3995-1ubuntu2.182:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSvimInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSvim-commonInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSvim-runtimeInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSvim-tinyInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSxxdInternally-facing2:8.2.3995-1ubuntu2.182:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSvimInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSvim-commonInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSvim-runtimeInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSvim-tinyInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSxxdInternally-facing2:8.2.3995-1ubuntu2.182:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSvimInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSvim-commonInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSvim-runtimeInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSvim-tinyInternally-facing2:8.2.3995-1ubuntu2.342:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSxxdInternally-facing2:8.2.3995-1ubuntu2.182:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSvimInternally-facing2:8.2.3995-1ubuntu2.322:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSvim-commonInternally-facing2:8.2.3995-1ubuntu2.322:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSvim-runtimeInternally-facing2:8.2.3995-1ubuntu2.322:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSvim-tinyInternally-facing2:8.2.3995-1ubuntu2.322:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSxxdInternally-facing2:8.2.3995-1ubuntu2.182:8.2.3995-1ubuntu2.35Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-73072, CVE-2026-73071, CVE-2026-73078, CVE-2026-28417, CVE-2026-73077, CVE-2026-73076, CVE-2026-73074

References

https://ubuntu.com/security/notices/USN-8657-1

https://nvd.nist.gov/vuln/detail/CVE-2026-73072

https://nvd.nist.gov/vuln/detail/CVE-2026-73071

https://nvd.nist.gov/vuln/detail/CVE-2026-73078

https://nvd.nist.gov/vuln/detail/CVE-2026-28417

https://nvd.nist.gov/vuln/detail/CVE-2026-73077

https://nvd.nist.gov/vuln/detail/CVE-2026-73076

https://nvd.nist.gov/vuln/detail/CVE-2026-73074

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
bionicvim2:8.0.1453-1ubuntu1.13+esm23
Ubuntu 20.04 LTSvim2:8.1.2269-1ubuntu5.32+esm12
Ubuntu 22.04 LTSvim2:8.2.3995-1ubuntu2.35
Ubuntu 24.04 LTSvim2:9.1.0016-1ubuntu7.19
resolutevim2:9.1.2141-1ubuntu4.8
trustyvim2:7.4.052-1ubuntu3.1+esm32
xenialvim2:7.4.1689-3ubuntu1.5+esm38