CVE-2026-52859

A flaw was found in Vim, an open-source command-line text editor. This vulnerability allows a program displaying output in a Vim terminal window to trigger an out-of-bounds write by sending a specific byte sequence. This can lead to a crash of the Vim application, resulting in a Denial of Service (DoS) for the user.

This Moderate flaw in Vim allows a local attacker to cause a denial of service. By displaying specially crafted output within a Vim :terminal window, an attacker can trigger an out-of-bounds write, leading to the application crashing. This primarily impacts users who interact with untrusted content or execute untrusted programs within Vim's terminal emulator.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Users should exercise caution when opening untrusted files or executing untrusted programs within vim's :terminal window. Avoiding interaction with untrusted content in this context can prevent the exploitation of this vulnerability, which leads to a denial of service.