DSA-6600-1 release notes and known issues

Summary

Multiple vulnerabilities were found and fixed in Vim, an enhanced version of the standard UNIX editor Vi (Vi IMproved). A remote attacker could trigger arbitrary code execution, command injection, or a crash (potential memory-corruption) via crafted files, archives, help/tag files, modelines, spell files, or crafted input to the NetBeans interface. CVE-2025-53905 - Path traversal in the tar plugin. The tar plugin did not protect archive member names against ".." traversal. CVE-2025-53906 - Path traversal in the zip plugin. The zip plugin did not protect archive member names against ".." traversal. CVE-2026-25749 - Buffer overflow in 'helpfile' option handling. Overlong help file paths could overflow a fixed-size buffer. CVE-2026-26269 - Buffer overflow in the NetBeans interface. Specially crafted NetBeans protocol input could overflow a buffer. CVE-2026-28417 - Command injection using netrw. Crafted file names could break out of netrw commands. CVE-2026-28418 - Crash with an overlong emacs tag file. An overlong tag line could crash the tag reader. CVE-2026-28419 - Buffer underflow with an emacs tag file. Crafted emacs tag files could cause an underflow. CVE-2026-28420 - Buffer overflow in terminal handling. Combining characters could overflow the terminal buffer. CVE-2026-28421 - Crash when recovering a corrupted swap file. Malformed swap files could crash vim during recovery. CVE-2026-28422 - Stack buffer overflow in build_stl_str_hl(). Multibyte fill characters could overflow the statusline buffer. CVE-2026-32249 - Crash with a composing char in a regexp range. A composing character ending a character range could corrupt the NFA regex compiler. CVE-2026-33412 - Command injection via newline in glob(). A newline in a glob pattern could inject shell commands. CVE-2026-34982 - Modeline security bypass. Modeline processing could be abused despite restrictions. CVE-2026-35177 - Path traversal in the zip plugin. Archive entries with ".." could escape the target directory. CVE-2026-39881 - Command injection in the NetBeans interface. defineAnnoType or special keys could inject Ex commands. CVE-2026-41411 - Command injection via backticks in tag files. Backticks in tag files could trigger shell execution. CVE-2026-42307 - netrw shell injection via sftp: and file: URLs. Malicious URLs could inject shell commands. CVE-2026-43961 - netrw code injection via the mf command. The mf command could run injected Vim script. CVE-2026-44656 - Backticks in 'path' cause shell execution on completion. Completion searched backtick expressions in 'path'. CVE-2026-45130 - Heap buffer overflow in spellfile.c read_compound(). A crafted spell file could overflow a heap buffer. CVE-2026-46483 - Command injection in the tar plugin. Archive filenames could inject shell commands. CVE-2026-47162 - netrw code injection via NetrwBookHistSave(). Bookmark/history data could inject Vim commands. CVE-2026-47167 - Code injection in the cucumber filetype plugin. Crafted Cucumber features could run Vim commands. CVE-2026-52858 - Code execution with python3complete. Completion could execute unsafe Python imports. CVE-2026-52859 - Out-of-bounds read in update_snapshot(). Terminal snapshots could cause an out-of-bounds read. CVE-2026-52860 - Code execution with python complete. Completion could execute unsafe Python code. CVE-2026-55693 - Out-of-bounds write in tree_count_words(). A crafted spell file could cause an out-of-bounds write. CVE-2026-55892 - Stack out-of-bounds write in dump_prefixes(). A crafted spell file could overflow the stack. CVE-2026-55895 - netrw code injection in local file deletion. Local file deletion could run injected commands. CVE-2026-57452 - Out-of-bounds read with sodium-encrypted files. Malformed encrypted files could cause an out-of-bounds read. CVE-2026-57455 - Out-of-bounds write with soundfold(). Crafted spell data could overflow when using soundfold(). CVE-2026-57456 - Code execution with python complete. Completion could execute unsa

Improvements and security content

• Multiple vulnerabilities were found and fixed in Vim, an enhanced version of the standard UNIX editor Vi (Vi IMproved). A remote attacker could trigger arbitrary code execution, command injection, or a crash (potential memory-corruption) via crafted files, archives, help/tag files, modelines, spell files, or crafted input to the NetBeans interface. CVE-2025-53905 - Path traversal in the tar plugin. The tar plugin did not protect archive member names against ".." traversal. CVE-2025-53906 - Path traversal in the zip plugin. The zip plugin did not protect archive member names against ".." traversal. CVE-2026-25749 - Buffer overflow in 'helpfile' option handling. Overlong help file paths could overflow a fixed-size buffer. CVE-2026-26269 - Buffer overflow in the NetBeans interface. Specially crafted NetBeans protocol input could overflow a buffer. CVE-2026-28417 - Command injection using netrw. Crafted file names could break out of netrw commands. CVE-2026-28418 - Crash with an overlong emacs tag file. An overlong tag line could crash the tag reader. CVE-2026-28419 - Buffer underflow with an emacs tag file. Crafted emacs tag files could cause an underflow. CVE-2026-28420 - Buffer overflow in terminal handling. Combining characters could overflow the terminal buffer. CVE-2026-28421 - Crash when recovering a corrupted swap file. Malformed swap files could crash vim during recovery. CVE-2026-28422 - Stack buffer overflow in build_stl_str_hl(). Multibyte fill characters could overflow the statusline buffer. CVE-2026-32249 - Crash with a composing char in a regexp range. A composing character ending a character range could corrupt the NFA regex compiler. CVE-2026-33412 - Command injection via newline in glob(). A newline in a glob pattern could inject shell commands. CVE-2026-34982 - Modeline security bypass. Modeline processing could be abused despite restrictions. CVE-2026-35177 - Path traversal in the zip plugin. Archive entries with ".." could escape the target directory. CVE-2026-39881 - Command injection in the NetBeans interface. defineAnnoType or special keys could inject Ex commands. CVE-2026-41411 - Command injection via backticks in tag files. Backticks in tag files could trigger shell execution. CVE-2026-42307 - netrw shell injection via sftp: and file: URLs. Malicious URLs could inject shell commands. CVE-2026-43961 - netrw code injection via the mf command. The mf command could run injected Vim script. CVE-2026-44656 - Backticks in 'path' cause shell execution on completion. Completion searched backtick expressions in 'path'. CVE-2026-45130 - Heap buffer overflow in spellfile.c read_compound(). A crafted spell file could overflow a heap buffer. CVE-2026-46483 - Command injection in the tar plugin. Archive filenames could inject shell commands. CVE-2026-47162 - netrw code injection via NetrwBookHistSave(). Bookmark/history data could inject Vim commands. CVE-2026-47167 - Code injection in the cucumber filetype plugin. Crafted Cucumber features could run Vim commands. CVE-2026-52858 - Code execution with python3complete. Completion could execute unsafe Python imports. CVE-2026-52859 - Out-of-bounds read in update_snapshot(). Terminal snapshots could cause an out-of-bounds read. CVE-2026-52860 - Code execution with python complete. Completion could execute unsafe Python code. CVE-2026-55693 - Out-of-bounds write in tree_count_words(). A crafted spell file could cause an out-of-bounds write. CVE-2026-55892 - Stack out-of-bounds write in dump_prefixes(). A crafted spell file could overflow the stack. CVE-2026-55895 - netrw code injection in local file deletion. Local file deletion could run injected commands. CVE-2026-57452 - Out-of-bounds read with sodium-encrypted files. Malformed encrypted files could cause an out-of-bounds read. CVE-2026-57455 - Out-of-bounds write with soundfold(). Crafted spell data could overflow when using soundfold(). CVE-2026-57456 - Code execution with python complete. Completion could execute unsa

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Lifecycle connections

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Official publisher evidence