Vim’s NFA regex compiler contains a null pointer dereference that leads to a segmentation fault. When a regular expression contains a character range whose endpoint includes a combining character, such as [0-0\u05bb], the compiler emits composing bytes as separate NFA states. This corrupts the NFA postfix stack, causing the NFA_START_COLL state’s out1 pointer to be NULL. A later traversal for look‑behind estimation dereferences state->out1->out without a NULL check, producing a crash. The impact is a denial of service via an application crash; no remote code execution or privilege escalation is indicated. The weakness is identified as CWE-476.

The vulnerability affects Vim versions from 9.1.0011 up through 9.2.0136. Affected vendors include vim:vim. Users running any of these versions are at risk until they upgrade.

The CVSS score is 5.3, indicating moderate severity, while the EPSS score is below 1%, implying a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivering a crafted regular expression to Vim, which is most likely a local attack vector; however, if Vim is invoked on untrusted content with elevated privileges, the resulting crash could compromise availability for that session. The official fix is to upgrade to Vim 9.2.0137 or later.