CVE-2026-28418: 
Vim vulnerability analysis and mitigation

CVE-2026-28418 is a heap-based buffer overflow (out-of-bounds read) vulnerability in Vim's Emacs-style tags file parsing logic. It affects all Vim versions prior to 9.2.0074 and was disclosed on February 27, 2026, by GitHub users ehdgks0627 and un3xploitable. The vulnerability was fixed in Vim version 9.2.0074, released the same day. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, though the GitHub Security Advisory rates it 4.4 (Moderate) (GitHub Advisory, Openwall).

The vulnerability is rooted in the emacs_tags_new_filename() function in src/tag.c (CWE-122: Heap-based Buffer Overflow; CWE-125: Out-of-bounds Read). When Vim processes an Emacs-style tags file, it reads a section header line into a fixed 512-byte heap buffer and then iterates through the buffer searching for a comma delimiter. If a crafted tags file supplies a line longer than 512 bytes without a comma, the search loop exhausts the buffer without finding the delimiter. The code then incorrectly assumes a comma was found and proceeds to check for an "include" directive by accessing up to 7 bytes beyond the allocated buffer boundary. The fix (commit f6a7f46) adds a bounds check that returns early if the loop reaches a null terminator without finding a comma (GitHub Commit, GitHub Advisory).

Successful exploitation causes Vim to crash due to an out-of-bounds heap read, resulting in a denial of availability for the affected Vim session. The out-of-bounds read may also expose up to 7 bytes of adjacent heap memory, creating a limited confidentiality risk. Integrity is not directly impacted, as the overflow is read-only. The attack is constrained to a local vector requiring user interaction (opening a malicious tags file), limiting the blast radius to individual user sessions rather than enabling lateral movement or remote code execution (GitHub Advisory, Openwall).

1. Craft a malicious Emacs tags file: Create a tags file containing a section header (\x0c form-feed character) followed by a line of 513 or more bytes with no comma character, exceeding the 512-byte heap buffer used by emacs_tags_new_filename().
2. Deliver the malicious file: Place the crafted tags file in a location the victim will use, such as a malicious code repository, a shared project directory, or a downloaded archive. The file should be named or configured to be loaded as a Vim tags file (e.g., referenced via Vim's tags option).
3. Induce user interaction: Convince the target user to open a file in Vim within the directory containing the malicious tags file, or to explicitly run a tag lookup command (e.g., :tag <name>) that causes Vim to parse the crafted tags file.
4. Trigger the out-of-bounds read: Vim's emacs_tags_new_filename() function reads the overlong line into the 512-byte buffer and iterates past the boundary searching for a comma, reading up to 7 bytes beyond the allocation — crashing Vim or potentially leaking adjacent heap memory (GitHub Advisory, GitHub Commit).

• File System: Presence of an unexpected or externally sourced tags file (e.g., named TAGS or tags) in a project directory containing a form-feed byte (\x0c) followed by a line exceeding 512 bytes without a comma delimiter.
• Logs: Vim crash reports or core dumps associated with tag lookup operations; error messages referencing E426 (tag not found) when processing Emacs-style tags files.
• Process: Unexpected termination of Vim processes immediately following a :tag command or tag completion action, particularly when operating on externally sourced codebases (GitHub Advisory).

Upgrade Vim to version 9.2.0074 or later, which contains the fix in commit f6a7f46 (GitHub Release). Downstream distributions including Ubuntu (USN-8101-1), Fedora, Mageia, and Amazon Linux 2023 (ALAS2023-2026-1584) have released updated packages. As a workaround until patching is complete, users should avoid opening tags files from untrusted sources and refrain from using Emacs-style tags files in untrusted project directories. Microsoft has also released updated packages for CBL-Mariner and Azure Linux distributions (Microsoft MSRC).

The vulnerability was responsibly disclosed by GitHub users ehdgks0627 and un3xploitable, who provided a proof-of-concept to the Vim maintainers. Vim maintainer Christian Brabandt published the fix and coordinated disclosure via the oss-security mailing list on the same day as the patch release (Openwall). The issue received routine coverage from Linux security news outlets and distribution security teams, with no significant controversy or elevated community concern given its medium severity and read-only nature.