CVE-2026-28422: 
Vim vulnerability analysis and mitigation

CVE-2026-28422 is a stack-based buffer overflow vulnerability in Vim's build_stl_str_hl() function, triggered when rendering a statusline with a multi-byte fill character on a very wide terminal. It affects all Vim versions prior to 9.2.0078 and was disclosed on February 27, 2026, by GitHub users ehdgks0627 and un3xploitable, who also provided a proof-of-concept. The vulnerability carries a CVSS v3.1 base score of 2.2 (Low), reflecting its constrained local exploitation requirements (GitHub Advisory, Openwall OSS-Sec).

The root cause is an incorrect size check in build_stl_str_hl() that evaluates available buffer space in screen cells rather than bytes (CWE-121: Stack-based Buffer Overflow; CWE-135: Incorrect Calculation of Multi-Byte String Length). Vim uses a fixed-size stack buffer of MAXPATHL = 4096 bytes to build the statusline string. When a multi-byte fill character (e.g., U+2500, which requires 3 bytes per cell) is used with the %= statusline separator on a terminal wider than approximately 1365 columns, the byte count exceeds the 4096-byte buffer while the cell-count check still passes, resulting in a stack overflow of up to 1904 bytes. The fix in commit 4e5b9e3 updates the size check to use MB_CHAR2LEN(fillchar) to account for the actual byte length of the fill character (GitHub Commit, GitHub Advisory).

Successful exploitation leads to memory corruption on the stack, which can cause unpredictable behavior or crashes when the statusline is redrawn. The integrity impact is rated Low with no confidentiality or availability impact per the CVSS score, though memory corruption could theoretically lead to more severe outcomes in specific environments. An attacker must be able to influence a user's fillchars or statusline settings — for example, via a malicious modeline or plugin — limiting the practical attack surface significantly (GitHub Advisory, Openwall OSS-Sec).

1. Identify a target: Locate a system running Vim prior to version 9.2.0078 where the attacker can influence Vim configuration (e.g., via a malicious .vimrc, modeline embedded in a file, or a rogue plugin).
2. Craft a malicious configuration: Prepare a Vim modeline or configuration snippet that sets a multi-byte fill character (e.g., U+2500 ─) in the fillchars option and configures a statusline using %= to trigger fill character rendering: set fillchars=stl:─ statusline=%=.
3. Deliver the payload: Trick the target user into opening a file containing the malicious modeline, or place the configuration in a shared plugin or .vimrc file accessible to the victim.
4. Trigger on a wide terminal: The overflow is triggered when the user's terminal is wider than approximately 1365 columns and the statusline is redrawn (e.g., on window resize or file open), causing the fill loop to write up to 1904 bytes beyond the 4096-byte MAXPATHL stack buffer.
5. Achieve memory corruption: The stack buffer overflow corrupts adjacent stack memory, potentially causing unpredictable behavior, crashes, or — in theory — code execution depending on the environment and stack layout (GitHub Advisory, GitHub Commit).

• File System: Unexpected or modified .vimrc, plugin files, or project-local .vim configuration files containing fillchars settings with multi-byte characters (e.g., U+2500 ─) combined with %= in statusline.
• File System: Malicious modelines embedded in text files (e.g., lines matching vim: set fillchars=stl:─) that could be delivered via shared documents or repositories.
• Logs: Application crash logs or core dumps originating from the vim process, particularly referencing build_stl_str_hl() in stack traces.
• Process: Vim processes crashing or producing segmentation faults on systems with very wide terminal emulators (>1365 columns).

Upgrade Vim to version 9.2.0078 or later, which corrects the size check in build_stl_str_hl() to use byte length (MB_CHAR2LEN) rather than cell width. Linux distribution packages (Fedora, Ubuntu, Mageia, Amazon Linux 2023, and others) have released updated packages incorporating this fix. As a temporary workaround, avoid using multi-byte characters as fill characters in fillchars or statusline settings, and disable modeline processing (set nomodeline) to prevent untrusted files from altering Vim configuration. Given the low CVSS score and absence of active exploitation, this can be addressed during regular maintenance windows (GitHub Release, Ubuntu Advisory).

The vulnerability was disclosed responsibly by Christian Brabandt (Vim maintainer) to the oss-security mailing list on February 27, 2026, with a patch released simultaneously. Multiple Linux distributions including Fedora, Ubuntu, Mageia, and Amazon Linux 2023 issued security advisories and updated packages shortly after disclosure. The security community generally treated this as a low-priority issue given its constrained exploitation requirements and low CVSS score (Openwall OSS-Sec, Ubuntu Advisory).