CVE-2026-73070

A flaw was found in Vim. The socket server backend accepts an unbounded number of client connections, causing file descriptors to overflow internal data structures. A local process able to connect to the server socket can exploit this to corrupt stack memory or terminate the Vim server. This can lead to a denial of service (DoS) for the Vim server.

This vulnerability is rated as Moderate severity because exploitation is restricted to local attackers, requires specific non-default server execution, and only results in a denial of service. Under typical Red Hat Enterprise Linux deployments, Vim operates as an interactive command-line editor and does not run in background server mode by default. Furthermore, standard binary hardening flags like FORTIFY_SOURCE on Red Hat systems ensure that descriptor table overruns cause an immediate process abort rather than arbitrary code execution, limiting the practical impact to the termination of the active editing session.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.