CVE-2026-57452
Medium
Description
Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.
SeverityMedium
CVSS5.5
Exploit probability—
ProductVim
PublishedJun 25, 2026
First seenJun 25, 2026
Weakness typeCWE-125Out-of-bounds readCWE-191CWE-191
How to fix
Update
- vim vim9.2.0671 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vim vim | v < 9.2.0671 | 9.2.0671 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.