Description
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.
Published: 2026-08-11
Score: 3.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use-after-free vulnerability in Vim's json_decode_item occurs when an invalid JSON string spans input buffers, causing the code to read freed memory and potentially crash the editor. This defect can lead to application crashes, which represents a denial-of-service condition for users or processes relying on Vim. The weakness is a memory corruption flaw (CWE-416).

Affected Systems

Vim versions 9.2.0511 up to and including 9.2.0844 contain the flaw. The issue is resolved starting with release 9.2.0844.

Risk and Exploitability

The CVSS score of 3.3 indicates low severity and the EPSS score is not available. The vulnerability is not listed in CISA's KEV catalog. Based on the description it is inferred that the attacker must have local access to Vim and supply malformed JSON input to trigger the crash; this local attack vector limits the threat to systems where Vim is exposed to untrusted input. Although the vulnerability does not provide remote code execution or privilege escalation, the possibility of denial of service warrants prompt remediation.

Generated by OpenCVE AI on August 11, 2026 at 22:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Vim to version 9.2.0844 or later, which contains the fix for the use-after-free bug.
  • If an immediate upgrade is not possible, restrict the use of Vim to trusted users only and avoid feeding malformed JSON data through the editor or related scripts.
  • Monitor Vim processes for unexpected crashes or segmentation faults; investigate any such incidents promptly as they may indicate exploitation attempts.

Generated by OpenCVE AI on August 11, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Tue, 11 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Vim
Vim vim
Vendors & Products Vim
Vim vim

Tue, 11 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Description Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.
Title Vim: Use-after-free in JSON Decoding
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Vim Vim
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-11T16:47:48.674Z

Reserved: 2026-08-10T19:37:41.444Z

Link: CVE-2026-73071

cve-icon Vulnrichment

Updated: 2026-08-11T16:47:33.480Z

cve-icon NVD

Status : Received

Published: 2026-08-11T16:17:38.413

Modified: 2026-08-11T17:19:15.437

Link: CVE-2026-73071

cve-icon Redhat

Severity : Low

Publid Date: 2026-08-11T15:29:30Z

Links: CVE-2026-73071 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T23:15:12Z

Weaknesses