Vim

Product

Vim is a free and open-source text editor. Vim provides both a terminal screen user interface as well as a graphical user interface.

From Wikipedia, licensed under CC BY-SA 4.0. Shown as published there.

Facts

Made by: Bram MoolenaarSource: Wikidata
First released: 1991Source: Wikidata
Latest version: 9.2.0 (2026)Source: Wikidata
Licence: GNU General Public License, Vim licenseSource: Wikidata
Runs on: Android, BSD, Linux, macOS, Microsoft WindowsSource: Wikidata
Official website: www.vim.orgSource: Wikidata
Wikipedia: Read on WikipediaSource: Wikidata

Vulnerabilities

20 CVEs in our records, 0 known exploited (on CISA's KEV list).

0Critical

14High

6Medium

0Low

0No score

Source: NVD and CISA KEV

Am I affected?

Checked against NVD affected-version data on our server. Nothing you type is stored.

Affected versions

CVE-2026-73074 from 9.2.0320, before 9.2.0841 · fixed in 9.2.0841
CVE-2026-73070 from 9.2.0512, before 9.2.0842 · fixed in 9.2.0842
CVE-2022-1725 before 8.2.4959 · fixed in 8.2.4959
CVE-2022-3235 before 9.0.0490 · fixed in 9.0.0490
CVE-2022-3234 before 9.0.0483 · fixed in 9.0.0483
CVE-2022-3153 before 9.0.0404 · fixed in 9.0.0404
CVE-2022-3134 before 9.0.0389 · fixed in 9.0.0389
CVE-2022-3099 before 9.0.0360 · fixed in 9.0.0360
CVE-2022-3037 before 9.0.0322 · fixed in 9.0.0322
CVE-2022-3016 before 9.0.0286 · fixed in 9.0.0286
CVE-2022-2982 before 9.0.0260 · fixed in 9.0.0260
CVE-2022-2980 before 9.0.0259 · fixed in 9.0.0259

Source: NVD

Security timeline

8 November 2026Security update reported by Debian Security AdvisoriesDebian releases regression fix for vim s390x build failure
1 November 2026Vulnerability reported by Debian Security AdvisoriesDebian issues vim security update fixing 40 vulnerabilities

Recent news

Debian Security Advisories· 2h

Debian releases regression fix for vim s390x build failure

Debian's DSA-6600-2 is a regression update for vim. The earlier DSA-6600-1 update produced binary packages that were not correctly built for s390x because of test failures during the build. This update corrects that build problem.

Am I affected?1

Debian Security Advisories· 1 Nov· High

Debian issues vim security update fixing 40 vulnerabilities

Debian advisory DSA-6600-1 covers 40 CVEs in Vim, spanning path traversal in the tar and zip plugins, buffer overflows and underflows, out-of-bounds reads and writes, crashes, and command or code injection. Several issues are reachable through netrw, NetBeans, completion, spell files and tag files, so the risk comes from opening untrusted content. Systems running Vim should install the Debian update.

Am I affected?1