CVE-2026-52859— Vim: Out-of-bounds Read in Terminal Screen Snapshot
Possible ATT&CK Techniques 2AI
T1203 · Exploitation for Client Execution T1498 · Network Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-52859
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vim: Out-of-bounds Read in Terminal Screen Snapshot
Source: NVD (National Vulnerability Database)
Vulnerability Description
Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨界内存读
Source: NVD (National Vulnerability Database)
Vulnerability Title
Vim 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vim是Vim开源的一款跨平台的文本编辑器。 Vim 9.2.0565之前版本存在缓冲区错误漏洞，该漏洞源于update_snapshot()函数在复制可见终端屏幕到滚动缓冲区时，对每个屏幕单元的chars[]数组无上限遍历，当单元填满所有VTERM_MAX_CHARS_PER_CELL（6）个槽位时，libvterm返回无终止NUL的数组，导致越界读取并附加到仅保留6个字符的缓冲区，可能导致崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-52859
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-52859
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-52859 (1)
Vendor Advisories for CVE-2026-52859 (1)
Vendor Pages for CVE-2026-52859 (1)
- 🔗 Release v9.2.0565 · vim/vim · GitHubx_refsource_MISC
Same Patch Batch · vim · 2026-06-11 · 5 CVEs total
| CVE-2026-47167 | Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition rege | |
| CVE-2026-47162 | Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name | |
| CVE-2026-52858 | Vim: Arbitrary Code Execution via Python Omni-Completion | |
| CVE-2026-52860 | Vim: Arbitrary Code Execution via Python Omni-Completion |
IV. Related Vulnerabilities
Same product: vim
- CVE-2026-55693
Vim: Out-of-bounds Write in Spell File Word Count - CVE-2026-55892
Vim: Out-of-bounds Write in Spell File Prefix Dump - CVE-2026-55895
Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() vi - CVE-2026-57451
Vim: Out-of-bounds Read in Text Property Count - CVE-2026-57452
Vim: Out-of-bounds Read with libsodium-encrypted Files
Same vendor: vim
- CVE-2026-55693
Vim: Out-of-bounds Write in Spell File Word Count - CVE-2026-55892
Vim: Out-of-bounds Write in Spell File Prefix Dump - CVE-2026-55895
Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() vi - CVE-2026-57451
Vim: Out-of-bounds Read in Text Property Count - CVE-2026-57452
Vim: Out-of-bounds Read with libsodium-encrypted Files
Same weakness: CWE-125
- CVE-2026-54341
Dragonfly: RESTORE operations may crash the server - CVE-2026-12340
Out-of-bounds heap read in SM2/SM3 certificate Subject Key I - CVE-2026-56788
RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index i - CVE-2026-12897
Out-of-bounds read in Horner Automation Cscape - CVE-2026-6094
Heap buffer overread in wc_PKCS7_DecodeEnvelopedData parsing
V. Comments for CVE-2026-52859
No comments yet