CVE-2026-32249: 
Vim vulnerability analysis and mitigation

CVE-2026-32249 is a NULL pointer dereference vulnerability in Vim's NFA regex compiler that causes a segmentation fault (denial of service) when processing specially crafted regex patterns. It affects Vim versions from 9.1.0011 up to (but not including) 9.2.0137, introduced by patch 9.1.0011. The vulnerability was discovered by Nathan Mills through fuzzing and disclosed on March 11–12, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, or 5.3 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Red Hat).

The root cause is a NULL pointer dereference (CWE-476) in Vim's NFA regex engine (src/regexp_nfa.c). When the NFA compiler encounters a character collection containing a combining Unicode character as the endpoint of a character range (e.g., [0-0\u05bb]), it incorrectly emits the composing bytes of that character as separate NFA states, corrupting the NFA postfix stack. This leaves NFA_START_COLL with a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for a look-behind assertion, it dereferences state->out1->out without a NULL check, triggering a segmentation fault. The fix, applied in commit 36d6e87, adds a range_endpoint flag to suppress emission of composing characters when a character is used as a range endpoint, and adds a NULL guard in nfa_max_width() (GitHub Commit, GitHub Advisory).

Successful exploitation causes Vim to crash via a segmentation fault, resulting in a denial of service. Any user or process that can supply a regex pattern to Vim — including via plugins, command-line arguments, or malicious files opened in Vim — can trigger the crash. There is no impact on confidentiality or data integrity; the vulnerability is limited to availability of the Vim process (GitHub Advisory, Red Hat).

1. Identify a vulnerable target: Confirm the target system is running Vim version 9.1.0011 through 9.2.0136 (inclusive).
2. Craft a malicious file or regex: Create a file or Vim script containing a regex pattern with a character collection that uses a combining Unicode character as a range endpoint, such as /\(.*\)\@<=[0-0\u05bb]/ or a look-behind assertion referencing such a collection.
3. Deliver the payload: Induce the target user to open the crafted file in Vim, or supply the regex via a command-line argument (e.g., vim -c 'let x = matchstr("test", "[0-0\u05bb]")'), or via a malicious Vim plugin.
4. Trigger the crash: When Vim's NFA regex engine compiles the pattern and nfa_max_width() traverses the resulting NFA, it dereferences the NULL out1 pointer, causing a segmentation fault and crashing Vim (GitHub Advisory, GitHub Commit).

• Process: Vim process terminating unexpectedly with a segmentation fault (SIGSEGV); core dump files generated in the working directory or /var/crash/.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing entries like vim[PID]: segfault at ... or signal 11 (SIGSEGV).
• File System: Unexpected core dump files (e.g., core, core.<pid>) in directories where Vim was executed; presence of files containing regex patterns with combining Unicode characters in character ranges (e.g., [0-0\u05bb]).

Upgrade Vim to version 9.2.0137 or later, which contains the security fix introduced in commit 36d6e87 (GitHub Release). Linux distribution packages have been updated for Fedora, Mageia, Ubuntu, and Amazon Linux 2023, among others. As a workaround where upgrading is not immediately possible, avoid opening untrusted files or executing regex patterns containing combining Unicode characters in character ranges within Vim (GitHub Advisory, Red Hat).

The vulnerability was credited to Nathan Mills, who identified it through fuzzing and provided a minimal reproducer and detailed analysis to the Vim project. The Vim maintainer Christian Brabandt (chrisbra) published the fix and GitHub Security Advisory on March 11, 2026. The issue received routine coverage from Linux security news aggregators and distribution security teams (Fedora, Mageia, Ubuntu, Amazon Linux), with no significant broader media or social media attention given its moderate severity and limited exploitability (GitHub Advisory).