CVE-2026-26269

A flaw was found in Vim. A stack-based buffer overflow in the NetBeans integration can be triggered in the special_keys function in the src/netbeans.c file via a malicious NetBeans server due to improper bounds checking, most likely resulting in a denial of service or in arbitrary command execution.

To exploit this issue, an attacker needs to set up a malicious NetBeans server or perform a Man-in-the-Middle attack on an unencrypted connection to be able to send a crafted payload into an existing NetBeans session.

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.

Due to these reasons, this vulnerability has been rated with a low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, do not start Vim with the -nb command line option. Also, users should avoid manually running commands that initiate a NetBeans connection, such as :nbstart or :nbkey.