Debian issues vim security update fixing 40 vulnerabilities
- Severity
- High
- Highest CVSS
- 7.8
- Exploited
- Not known
- Sources
- 1
What happened
DSA-6600-1 addresses 40 Vim CVEs, including CVE-2025-53905 and CVE-2025-53906 (tar and zip plugin path traversal), CVE-2026-26269 (NetBeans buffer overflow), CVE-2026-39881 (NetBeans Ex command injection), CVE-2026-42307 (netrw sftp:/file: URL shell injection), CVE-2026-46483 (tar plugin filename command injection), and CVE-2026-45130 (heap overflow in spellfile.c readcompound()). Many others cover command injection via backticks, glob() newlines, netrw bookmarks and history, Python and PHP omni-completion, and out-of-bounds or stack overflows in spell and terminal code. The fixed Vim package version is not stated in the provided text, so defenders should apply the Debian update and verify the installed version.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Install the vim security update published in Debian advisory DSA-6600-1.
- Review the advisory to confirm which Vim packages and versions are affected in your environment.
- Avoid opening untrusted archives, spell files or help files in Vim until the update is applied.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
- Wed 19 AugustCVE-2026-43961 published, CVSS 7.8NVD
- Sun 1 NovemberDSA-6600-1 vim - security updateDebian Security Advisories