CVE-2026-34982 - Vulnerability Analysis

Overview

Vim < 9.2.0276 contains a command injection caused by missing sandbox restrictions in modeline options and mapset() function, letting attackers execute arbitrary OS commands by opening crafted files, exploit requires opening malicious files.

Severity & Score

Impact

Attackers can execute arbitrary OS commands by opening crafted files, potentially leading to full system compromise.

Mitigation

Update to version 9.2.0276 or later.

References

• https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615
• https://github.com/vim/vim/releases/tag/v9.2.0276
• https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9
• http://www.openwall.com/lists/oss-security/2026/04/01/1

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner