QSN-8657-1: Vim vulnerabilities
2026-08-20

Summary:
Several security issues were fixed in Vim.

Details:
It was discovered that Vim incorrectly handled memory when decoding
certain JSON input. An attacker could possibly use this issue to cause
Vim to crash, resulting in a denial of service. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-73071)

Yazan Balawneh discovered that Vim incorrectly handled memory when
opening certain spell files. An attacker could possibly use this issue to
cause Vim to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2026-73072)

It was discovered that Vim incorrectly handled memory when processing
certain files with a large number of text properties. An attacker could
possibly use this issue to cause Vim to crash, resulting in a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-73074)

It was discovered that Vim incorrectly handled certain vimball files. An
attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-73076)

It was discovered that Vim incorrectly handled shell arguments during
keyword lookups. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, and Ubuntu 26.04 LTS. (CVE-2026-73077)

David Carliez discovered that Vim incorrectly handled certain directory
paths when constructing netrw menus. An attacker could possibly use this
issue to execute arbitrary code. (CVE-2026-73078)

Affected QuantaStor releases:
  6.9.1.001 jammy: vim 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.9.1.001 jammy: vim-common 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.9.1.001 jammy: vim-runtime 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.9.1.001 jammy: vim-tiny 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.9.1.001 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.9.0.464 jammy: vim 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.9.0.464 jammy: vim-common 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.9.0.464 jammy: vim-runtime 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.9.0.464 jammy: vim-tiny 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.9.0.464 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.6.015 jammy: vim 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.6.015 jammy: vim-common 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.6.015 jammy: vim-runtime 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.6.015 jammy: vim-tiny 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.6.015 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.5.018 jammy: vim 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.5.018 jammy: vim-common 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.5.018 jammy: vim-runtime 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.5.018 jammy: vim-tiny 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.5.018 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.4.038 jammy: vim 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.4.038 jammy: vim-common 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.4.038 jammy: vim-runtime 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.4.038 jammy: vim-tiny 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.4.038 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.3.018 jammy: vim 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.3.018 jammy: vim-common 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.3.018 jammy: vim-runtime 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.3.018 jammy: vim-tiny 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.3.018 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.2.002 jammy: vim 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.2.002 jammy: vim-common 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.2.002 jammy: vim-runtime 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.2.002 jammy: vim-tiny 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.2.002 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.1.007 jammy: vim 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.1.007 jammy: vim-common 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.1.007 jammy: vim-runtime 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.1.007 jammy: vim-tiny 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.1.007 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.0.205 jammy: vim 2:8.2.3995-1ubuntu2.32 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.0.205 jammy: vim-common 2:8.2.3995-1ubuntu2.32 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.0.205 jammy: vim-runtime 2:8.2.3995-1ubuntu2.32 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.0.205 jammy: vim-tiny 2:8.2.3995-1ubuntu2.32 (fixed in 2:8.2.3995-1ubuntu2.35)
  6.8.0.205 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.35)

CVEs: CVE-2026-73072, CVE-2026-73071, CVE-2026-73078, CVE-2026-28417, CVE-2026-73077, CVE-2026-73076, CVE-2026-73074

References:
  https://ubuntu.com/security/notices/USN-8657-1