CVE-2026-28419: 
Vim vulnerability analysis and mitigation

CVE-2026-28419 is a heap-based buffer underflow vulnerability in Vim's Emacs-style tags file parsing logic, affecting all versions prior to 9.2.0075. When processing a malformed tags file where a 0x7f delimiter appears at the very start of a line, Vim attempts to read memory immediately preceding the heap-allocated buffer, resulting in a 1-byte out-of-bounds read. The vulnerability was disclosed on February 27, 2026, by researchers ehdgks0627 and un3xploitable, and fixed in Vim 9.2.0075 released the same day. It carries a CVSS v3.1 base score of 5.3 (Moderate) per the GitHub Security Advisory, though some sources score it as 6.6 (Medium) (GitHub Advisory, Openwall).

The vulnerability is rooted in the emacs_tags_parse_line() function in src/tag.c (CWE-124: Buffer Underwrite / CWE-125: Out-of-bounds Read). When parsing Emacs-style tags in the "second format" (where the tag name is not explicitly provided), the code scans backward from the 0x7f delimiter to isolate the tag name. If p_7f == lbuf (i.e., the delimiter is at the very beginning of the line), the pointer arithmetic p = p_7f - 1 produces a pointer that precedes the start of the heap-allocated buffer; the code then dereferences this pointer in a vim_iswordc() check before performing any bounds verification, triggering the out-of-bounds read. The fix, introduced in commit 9b7dfa2, adds a guard check (if (p_7f == lbuf) goto etag_fail;) before the backward scan (GitHub Commit, GitHub Advisory). A proof-of-concept crash artifact was provided by the reporters as part of responsible disclosure (Openwall).

Successful exploitation results in a 1-byte heap out-of-bounds read, which can cause Vim to crash (Denial of Service). There is also a low-impact risk of limited memory disclosure (confidentiality) and minor integrity impact, though the primary consequence is application instability. Because the underflow is read-only and limited to a single byte, the risk of arbitrary code execution is considered low; the vulnerability does not enable lateral movement or significant data exfiltration (GitHub Advisory, Openwall).

No public proof-of-concept exploit code is currently available beyond the crash artifact shared during responsible disclosure, and there is no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.004% (0.000040), reflecting a very low probability of exploitation in the near term. Exploitation requires local access and user interaction — specifically, a victim must perform a tag lookup (:tag) against a crafted malicious Emacs tags file (Openwall).

1. Craft a malicious Emacs tags file: Create a tags file where a 0x7f byte delimiter appears at the very beginning of a line (e.g., a line starting with \x7f followed by tag metadata), which triggers the second-format parsing path in emacs_tags_parse_line().
2. Deliver the file to the target: Social-engineer the victim into placing the malicious tags file in a project directory, or supply it via a shared repository, network share, or download.
3. Configure Vim to use the malicious tags file: The file must be referenced by Vim's tags option (e.g., :set tags=Xtags or by placing it as the default tags file in the working directory).
4. Trigger tag lookup: Induce the victim to execute a tag lookup command such as :tag a in Vim, which causes emacs_tags_parse_line() to parse the malformed file and perform the out-of-bounds read.
5. Achieve Denial of Service: The 1-byte heap buffer underflow causes Vim to crash, resulting in a DoS condition for the user's session (GitHub Advisory, GitHub Commit).

• File System: Presence of unexpected or externally sourced tags files (e.g., named tags, TAGS, or custom names) in project directories, particularly those containing binary content or lines beginning with the 0x7f byte.
• Logs: Vim crash reports or core dumps associated with tag lookup operations; error messages referencing E431 (no tags file) or segmentation faults in Vim process logs.
• Process: Unexpected termination of Vim processes immediately following :tag or Ctrl-] commands, especially when working with unfamiliar or externally provided codebases.

Upgrade Vim to version 9.2.0075 or later, which includes the fix introduced in commit 9b7dfa2 (GitHub Release). Downstream distributions including Ubuntu (USN-8101-1), Fedora, Mageia, and Amazon Linux 2023 have released updated packages incorporating this fix. As a workaround, avoid opening or performing tag lookups against tags files from untrusted or external sources, and consider validating tags files for unexpected binary content (particularly 0x7f bytes at line starts) before use (Openwall).

The vulnerability was responsibly disclosed by Christian Brabandt (Vim maintainer) to the oss-security mailing list on February 27, 2026, with credit to researchers ehdgks0627 and un3xploitable for identifying the issue and providing a proof-of-concept (Openwall). Microsoft acknowledged the vulnerability through its Security Response Center advisory. Multiple Linux distributions (Ubuntu, Fedora, Mageia, Amazon Linux) issued security advisories and updated packages in the weeks following disclosure, reflecting standard patch propagation for a moderate-severity editor vulnerability.