CVE-2026-32249

A flaw was found in Vim. A NULL pointer dereference can occur when the NFA regex compiler processes a specific character collection, more specifically one that contains a combining character acting as the endpoint of a character range (e.g., [0-0\u05bb]). A process or user that can supply a regex pattern can cause an application crash, resulting in a denial of service.

To exploit this issue, an attacker needs to be able to supply a malicious regex pattern to be processed by the NFA regex compiler, including via plugins or command line arguments. Also, this flaw can cause an application crash, resulting only in a denial of service with no other security impact. Due to these reasons, this vulnerability has been rated with low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable the NFA (Non-deterministic Finite Automaton) regex engine and enable the traditional backtracking engine by adding the following option to the Vim configuration file:

set regexpengine=1