CVE-2026-25749: 
NixOS vulnerability analysis and mitigation

CVE-2026-25749 is a heap-based buffer overflow vulnerability in Vim's tag file resolution logic, specifically in the handling of the 'helpfile' option. It affects all Vim versions prior to 9.1.2132, as well as Neovim versions up to and including 0.11.6. The vulnerability was reported by Rahul Hoysala and disclosed on February 5–6, 2026, with a patch released in Vim v9.1.2132. It carries a CVSS v3.1 base score of 6.6 (Medium) (GitHub Advisory, Oracle Bulletin).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow). The vulnerable code resides in the get_tagfname() function in src/tag.c, where the user-controlled 'helpfile' option value (p_hf) is copied into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() call with no bounds checking. The call chain ex_help() → find_help_tags() → find_tags() → get_tagfname() is triggered when a user executes the :help command after setting the 'helpfile' option to a string exceeding MAXPATHL bytes, causing a heap buffer overflow. The fix replaces STRCPY(buf, p_hf) with vim_strncpy(buf, p_hf, MAXPATHL - 1) to enforce a length limit (GitHub Commit, GitHub Advisory).

Successful exploitation can result in denial of service via application crash due to heap memory corruption, as well as potential arbitrary code execution depending on heap layout and exploitation technique. Integrity and availability are both rated High in the CVSS scoring, while confidentiality impact is None. The vulnerability is local in scope and requires low privileges and user interaction, limiting its blast radius, but heap corruption could theoretically allow an attacker to overwrite adjacent heap allocations or metadata to achieve code execution (GitHub Advisory).

A proof-of-concept exploit was provided by the reporter (Rahul Hoysala) and is referenced in the GitHub security advisory; it demonstrates the overflow using AddressSanitizer on both a standalone harness and an actual Vim build. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been made. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Set up a vulnerable environment: Obtain a system running Vim prior to version 9.1.2132 or Neovim ≤ 0.11.6 with local, low-privileged access.
2. Craft the payload: Prepare a string exceeding MAXPATHL (4096) bytes, e.g., using Python: python3 -c 'print("A" * 5000)'.
3. Set the helpfile option: In Vim, set the option to the oversized string via the command line or a Vim script: set helpfile=<5000-char string> (e.g., vim -u NONE -c "set helpfile=$(python3 -c 'print(\"A\" * 5000)')" -c "help" -c "q").
4. Trigger the vulnerable code path: Execute the :help command, which invokes ex_help() → find_help_tags() → find_tags() → get_tagfname(), causing STRCPY(buf, p_hf) to write 5000+ bytes into a 4097-byte heap buffer.
5. Achieve impact: The heap buffer overflow corrupts adjacent memory, causing an immediate crash (DoS) or, with advanced heap manipulation, potentially enabling arbitrary code execution (GitHub Advisory, GitHub Commit).

• Process: Vim or Neovim process crashing unexpectedly, particularly after executing the :help command; AddressSanitizer reports referencing get_tagfname in src/tag.c if Vim is built with ASan.
• Logs: Application crash logs or core dumps from the Vim process; system logs showing abnormal termination of vim or nvim processes.
• File System: Presence of core dump files (e.g., core, core.<pid>) in the working directory following a Vim crash; unexpected Vim configuration files (.vimrc, init.vim) setting the helpfile option to an unusually long string.
• Configuration: The 'helpfile' Vim option set to a value exceeding 4096 characters in any Vim configuration file or startup command.

The primary remediation is to upgrade Vim to version 9.1.2132 or later, which replaces the unsafe STRCPY() with a bounds-checked vim_strncpy() call (GitHub Commit). Neovim users should monitor for an upstream patch addressing this in their release line. As a workaround, avoid setting the 'helpfile' option to untrusted or user-controlled values, and restrict local access to systems running vulnerable Vim versions. Downstream distributions including Red Hat, AlmaLinux, Oracle Linux, Ubuntu, Fedora, Amazon Linux 2023, and IBM Cloud Pak for Data have released updated packages (Red Hat Advisory, Ubuntu Advisory).

The vulnerability was acknowledged and patched promptly by the Vim maintainer Christian Brabandt following a detailed report from researcher Rahul Hoysala, who provided both a standalone PoC harness and a full Vim reproduction case using AddressSanitizer. Multiple Linux distributions (Red Hat, Ubuntu, Fedora, AlmaLinux, Oracle Linux, Amazon Linux) issued security advisories and updated packages within weeks of disclosure. Oracle included the CVE in its April 2026 Solaris Third Party Bulletin, and IBM addressed it in Cloud Pak for Data System advisories (GitHub Advisory, Oracle Bulletin).