Vulnerability-Lookup

SUSE-SU-2026:1764-1

Vulnerability from csaf_suse - Published: 2026-05-08 10:39 - Updated: 2026-05-08 10:39

Summary

Security update for vim

Severity

Moderate

Notes

Title of the patch: Security update for vim

Description of the patch: This update for vim fixes the following issue: Security fixes: - CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833). Other fixes: - Update to 9.2.0398. * 9.2.0398: MS-Windows: missing strptime() support * 9.2.0397: tabpanel: double-click opens a new tab * 9.2.0396: tests: Test_error_callback_terminal is flaky on macOS * 9.2.0395: tests: Test_backupskip() may read from $HOME * 9.2.0394: xxd: offsets greater than LONG_MAX print as negative * 9.2.0393: MS-Windows: link error with XPM support on UCRT64 * 9.2.0392: tests: Some tests are flaky * 9.2.0391: tests: Comment in test_vim9_cmd breaks syntax highlighting * 9.2.0390: filetype: some Beancount files are not recognized * 9.2.0389: DECRQM still leaves stray 'pp' on Apple Terminal.app * 9.2.0388: strange indent in update_topline() * 9.2.0387: DECRQM request may leave stray chars in terminal * 9.2.0386: No scroll/scrollbar support in the tabpanel * 9.2.0385: Integer overflow with 'ze' and large 'sidescrolloff' * 9.2.0384: stale Insstart after <Cmd> cursor move breaks undo * 9.2.0383: [security]: runtime(netrw): shell-injection via sftp: and file: URLs * 9.2.0382: Wayland: focus-stealing is non-working * 9.2.0381: Vim9: Missing check_secure() in exec_instructions() * 9.2.0380: completion: a few issues in completion code * 9.2.0379: gui.color_approx is never used * 9.2.0378: Using int as bool type in win_T struct * 9.2.0377: Using int as bool type in gui_T struct * 9.2.0376: Vim9: elseif condition compiled in dead branch * 9.2.0375: prop_find() does not find a virt text in starting line * 9.2.0374: c_CTRL-{G,T} does not handle offset * 9.2.0373: Ctrl-R mapping not triggered during completion * 9.2.0372: pum: rendering issues with multibyte text and opacity * 9.2.0371: filetype: ghostty config files are not recognized * 9.2.0370: duplicate code with literal string_T assignment * 9.2.0369: multiple definitions of STRING_INIT macro * 9.2.0368: too many strlen() calls when adding strings to dicts * 9.2.0367: runtime(netrw): ~ note expanded on MS Windows * 9.2.0366: pum: flicker when updating pum in place * 9.2.0365: using int as bool * 9.2.0364: tests: test_smoothscroll_textoff_showbreak() fails * 9.2.0363: Vim9: variable shadowed by script-local function * 9.2.0362: division by zero with smoothscroll and small windows * 9.2.0361: tests: no tests for ch_listen() with IPs * 9.2.0360: Cannot handle mouse-clicks in the tabpanel * 9.2.0359: wrong VertSplitNC highlighting on winbar * 9.2.0358: runtime(vimball): still path traversal attacks possible * 9.2.0357: [security]: command injection via backticks in tag files * 9.2.0356: Cannot apply 'scrolloff' context lines at end of file * 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract() * 9.2.0354: filetype: not all Bitbake include files are recognized * 9.2.0353: Missing out-of-memory check in register.c * 9.2.0352: 'winhighlight' of left window blends into right window * 9.2.0351: repeat_string() can be improved * 9.2.0350: Enabling modelines poses a risk * 9.2.0349: cannot style non-current window separator * 9.2.0348: potential buffer underrun when setting statusline like option * 9.2.0347: Vim9: script-local variable not found * 9.2.0346: Wrong cursor position when entering command line window * 9.2.0345: Wrong autoformatting with 'autocomplete' * 9.2.0344: channel: ch_listen() can bind to network interface * 9.2.0343: tests: test_clientserver may fail on slower systems * 9.2.0342: tests: test_excmd.vim leaves swapfiles behind * 9.2.0341: some functions can be run from the sandbox * 9.2.0340: pum_redraw() may cause flicker * 9.2.0339: regexp: nfa_regmatch() allocates and frees too often * 9.2.0338: Cannot handle mouseclicks in the tabline * 9.2.0337: list indexing broken on big-endian 32-bit platforms * 9.2.0336: libvterm: no terminal reflow support * 9.2.0335: json_encode() uses recursive algorithm * 9.2.0334: GTK: window geometry shrinks with with client-side decorations * 9.2.0333: filetype: PklProject files are not recognized * 9.2.0332: popup: still opacity rendering issues * 9.2.0331: spellfile: stack buffer overflows in spell file generation * 9.2.0330: tests: some patterns in tar and zip plugin tests not strict enough * 9.2.0329: tests: test_indent.vim leaves swapfiles behind * 9.2.0328: Cannot handle mouseclicks in the statusline * 9.2.0327: filetype: uv scripts are not detected * 9.2.0326: runtime(tar): but with dotted path * 9.2.0325: runtime(tar): bug in zstd handling * 9.2.0324: 0x9b byte not unescaped in <Cmd> mapping * 9.2.0323: filetype: buf.lock files are not recognized * 9.2.0322: tests: test_popupwin fails * 9.2.0321: MS-Windows: No OpenType font support * 9.2.0320: several bugs with text properties * 9.2.0319: popup: rendering issues with partially transparent popups * 9.2.0318: cannot configure opacity for popup menu * 9.2.0317: listener functions do not check secure flag * 9.2.0316: [security]: command injection in netbeans interface via defineAnnoType * 9.2.0315: missing bound-checks * 9.2.0314: channel: can bind to all network interfaces * 9.2.0313: Callback channel not registered in GUI * 9.2.0312: C-type names are marked as translatable * 9.2.0311: redrawing logic with text properties can be improved * 9.2.0310: unnecessary work in vim_strchr() and find_term_bykeys() * 9.2.0309: Missing out-of-memory check to may_get_cmd_block() * 9.2.0308: Error message E1547 is wrong * 9.2.0307: more mismatches between return types and documentation * 9.2.0306: runtime(tar): some issues with lz4 support * 9.2.0305: mismatch between return types and documentation * 9.2.0304: tests: test for 9.2.0285 doesn't always fail without the fix * 9.2.0303: tests: zip plugin tests don't check for warning message properly * 9.2.0302: runtime(netrw): RFC2396 decoding double escaping spaces * 9.2.0301: Vim9: void function return value inconsistent * 9.2.0300: The vimball plugin needs some love * 9.2.0299: runtime(zip): may write using absolute paths * 9.2.0298: Some internal variables are not modified * 9.2.0297: libvterm: can improve CSI overflow code * 9.2.0296: Redundant and incorrect integer pointer casts in drawline.c * 9.2.0295: 'showcmd' shows wrong Visual block size with 'linebreak' * 9.2.0294: if_lua: lua interface does not work with lua 5.5 * 9.2.0293: :packadd may lead to heap-buffer-overflow * 9.2.0292: E340 internal error when using method call on void value * 9.2.0291: too many strlen() calls * 9.2.0290: Amiga: no support for AmigaOS 3.x * 9.2.0289: 'linebreak' may lead to wrong Visual block highlighting * 9.2.0288: libvterm: signed integer overflow parsing long CSI args * 9.2.0287: filetype: not all ObjectScript routines are recognized * 9.2.0286: still some unnecessary (int) casts in alloc() * 9.2.0285: :syn sync grouphere may go beyond end of line * 9.2.0284: tabpanel: crash when tabpanel expression returns variable line count * 9.2.0283: unnecessary (int) casts before alloc() calls * 9.2.0282: tests: Test_viminfo_len_overflow() fails * 9.2.0281: tests: Test_netrw_FileUrlEdit.. fails on Windows

Patchnames: SUSE-2026-1764,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-1764

CVE-2026-39881

6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gvim-9.2.0398-17.65.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-9.2.0398-17.65.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-data-9.2.0398-17.65.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-data-common-9.2.0398-17.65.1.noarch	—	Vendor Fix

Threats

Impact moderate

References

8 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2026…	self
https://bugzilla.suse.com/1261833	self
https://www.suse.com/security/cve/CVE-2026-39881/	self
https://www.suse.com/security/cve/CVE-2026-39881	external
https://bugzilla.suse.com/1261833	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for vim",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for vim fixes the following issue:\n\nSecurity fixes:\n\n- CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).\n\nOther fixes:\n\n- Update to 9.2.0398.\n * 9.2.0398: MS-Windows: missing strptime() support\n * 9.2.0397: tabpanel: double-click opens a new tab\n * 9.2.0396: tests: Test_error_callback_terminal is flaky on macOS\n * 9.2.0395: tests: Test_backupskip() may read from $HOME\n * 9.2.0394: xxd: offsets greater than LONG_MAX print as negative\n * 9.2.0393: MS-Windows: link error with XPM support on UCRT64\n * 9.2.0392: tests: Some tests are flaky\n * 9.2.0391: tests: Comment in test_vim9_cmd breaks syntax highlighting\n * 9.2.0390: filetype: some Beancount files are not recognized\n * 9.2.0389: DECRQM still leaves stray \u0027pp\u0027 on Apple Terminal.app\n * 9.2.0388: strange indent in update_topline()\n * 9.2.0387: DECRQM request may leave stray chars in terminal\n * 9.2.0386: No scroll/scrollbar support in the tabpanel\n * 9.2.0385: Integer overflow with \u0027ze\u0027 and large \u0027sidescrolloff\u0027\n * 9.2.0384: stale Insstart after \u003cCmd\u003e cursor move breaks undo\n * 9.2.0383: [security]: runtime(netrw): shell-injection via sftp: and file: URLs\n * 9.2.0382: Wayland: focus-stealing is non-working\n * 9.2.0381: Vim9: Missing check_secure() in exec_instructions()\n * 9.2.0380: completion: a few issues in completion code\n * 9.2.0379: gui.color_approx is never used\n * 9.2.0378: Using int as bool type in win_T struct\n * 9.2.0377: Using int as bool type in gui_T struct\n * 9.2.0376: Vim9: elseif condition compiled in dead branch\n * 9.2.0375: prop_find() does not find a virt text in starting line\n * 9.2.0374: c_CTRL-{G,T} does not handle offset\n * 9.2.0373: Ctrl-R mapping not triggered during completion\n * 9.2.0372: pum: rendering issues with multibyte text and opacity\n * 9.2.0371: filetype: ghostty config files are not recognized\n * 9.2.0370: duplicate code with literal string_T assignment\n * 9.2.0369: multiple definitions of STRING_INIT macro\n * 9.2.0368: too many strlen() calls when adding strings to dicts\n * 9.2.0367: runtime(netrw): ~ note expanded on MS Windows\n * 9.2.0366: pum: flicker when updating pum in place\n * 9.2.0365: using int as bool\n * 9.2.0364: tests: test_smoothscroll_textoff_showbreak() fails\n * 9.2.0363: Vim9: variable shadowed by script-local function\n * 9.2.0362: division by zero with smoothscroll and small windows\n * 9.2.0361: tests: no tests for ch_listen() with IPs\n * 9.2.0360: Cannot handle mouse-clicks in the tabpanel\n * 9.2.0359: wrong VertSplitNC highlighting on winbar\n * 9.2.0358: runtime(vimball): still path traversal attacks possible\n * 9.2.0357: [security]: command injection via backticks in tag files\n * 9.2.0356: Cannot apply \u0027scrolloff\u0027 context lines at end of file\n * 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract()\n * 9.2.0354: filetype: not all Bitbake include files are recognized\n * 9.2.0353: Missing out-of-memory check in register.c\n * 9.2.0352: \u0027winhighlight\u0027 of left window blends into right window\n * 9.2.0351: repeat_string() can be improved\n * 9.2.0350: Enabling modelines poses a risk\n * 9.2.0349: cannot style non-current window separator\n * 9.2.0348: potential buffer underrun when setting statusline like option\n * 9.2.0347: Vim9: script-local variable not found\n * 9.2.0346: Wrong cursor position when entering command line window\n * 9.2.0345: Wrong autoformatting with \u0027autocomplete\u0027\n * 9.2.0344: channel: ch_listen() can bind to network interface\n * 9.2.0343: tests: test_clientserver may fail on slower systems\n * 9.2.0342: tests: test_excmd.vim leaves swapfiles behind\n * 9.2.0341: some functions can be run from the sandbox\n * 9.2.0340: pum_redraw() may cause flicker\n * 9.2.0339: regexp: nfa_regmatch() allocates and frees too often\n * 9.2.0338: Cannot handle mouseclicks in the tabline\n * 9.2.0337: list indexing broken on big-endian 32-bit platforms\n * 9.2.0336: libvterm: no terminal reflow support\n * 9.2.0335: json_encode() uses recursive algorithm\n * 9.2.0334: GTK: window geometry shrinks with with client-side decorations\n * 9.2.0333: filetype: PklProject files are not recognized\n * 9.2.0332: popup: still opacity rendering issues\n * 9.2.0331: spellfile: stack buffer overflows in spell file generation\n * 9.2.0330: tests: some patterns in tar and zip plugin tests not strict enough\n * 9.2.0329: tests: test_indent.vim leaves swapfiles behind\n * 9.2.0328: Cannot handle mouseclicks in the statusline\n * 9.2.0327: filetype: uv scripts are not detected\n * 9.2.0326: runtime(tar): but with dotted path\n * 9.2.0325: runtime(tar): bug in zstd handling\n * 9.2.0324: 0x9b byte not unescaped in \u003cCmd\u003e mapping\n * 9.2.0323: filetype: buf.lock files are not recognized\n * 9.2.0322: tests: test_popupwin fails\n * 9.2.0321: MS-Windows: No OpenType font support\n * 9.2.0320: several bugs with text properties\n * 9.2.0319: popup: rendering issues with partially transparent popups\n * 9.2.0318: cannot configure opacity for popup menu\n * 9.2.0317: listener functions do not check secure flag\n * 9.2.0316: [security]: command injection in netbeans interface via defineAnnoType\n * 9.2.0315: missing bound-checks\n * 9.2.0314: channel: can bind to all network interfaces\n * 9.2.0313: Callback channel not registered in GUI\n * 9.2.0312: C-type names are marked as translatable\n * 9.2.0311: redrawing logic with text properties can be improved\n * 9.2.0310: unnecessary work in vim_strchr() and find_term_bykeys()\n * 9.2.0309: Missing out-of-memory check to may_get_cmd_block()\n * 9.2.0308: Error message E1547 is wrong\n * 9.2.0307: more mismatches between return types and documentation\n * 9.2.0306: runtime(tar): some issues with lz4 support\n * 9.2.0305: mismatch between return types and documentation\n * 9.2.0304: tests: test for 9.2.0285 doesn\u0027t always fail without the fix\n * 9.2.0303: tests: zip plugin tests don\u0027t check for warning message properly\n * 9.2.0302: runtime(netrw): RFC2396 decoding double escaping spaces\n * 9.2.0301: Vim9: void function return value inconsistent\n * 9.2.0300: The vimball plugin needs some love\n * 9.2.0299: runtime(zip): may write using absolute paths\n * 9.2.0298: Some internal variables are not modified\n * 9.2.0297: libvterm: can improve CSI overflow code\n * 9.2.0296: Redundant and incorrect integer pointer casts in drawline.c\n * 9.2.0295: \u0027showcmd\u0027 shows wrong Visual block size with \u0027linebreak\u0027\n * 9.2.0294: if_lua: lua interface does not work with lua 5.5\n * 9.2.0293: :packadd may lead to heap-buffer-overflow\n * 9.2.0292: E340 internal error when using method call on void value\n * 9.2.0291: too many strlen() calls\n * 9.2.0290: Amiga: no support for AmigaOS 3.x\n * 9.2.0289: \u0027linebreak\u0027 may lead to wrong Visual block highlighting\n * 9.2.0288: libvterm: signed integer overflow parsing long CSI args\n * 9.2.0287: filetype: not all ObjectScript routines are recognized\n * 9.2.0286: still some unnecessary (int) casts in alloc()\n * 9.2.0285: :syn sync grouphere may go beyond end of line\n * 9.2.0284: tabpanel: crash when tabpanel expression returns variable line count\n * 9.2.0283: unnecessary (int) casts before alloc() calls\n * 9.2.0282: tests: Test_viminfo_len_overflow() fails\n * 9.2.0281: tests: Test_netrw_FileUrlEdit.. fails on Windows\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-1764,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-1764",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1764-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:1764-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261764-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:1764-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-May/046318.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261833",
        "url": "https://bugzilla.suse.com/1261833"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39881 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39881/"
      }
    ],
    "title": "Security update for vim",
    "tracking": {
      "current_release_date": "2026-05-08T10:39:48Z",
      "generator": {
        "date": "2026-05-08T10:39:48Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:1764-1",
      "initial_release_date": "2026-05-08T10:39:48Z",
      "revision_history": [
        {
          "date": "2026-05-08T10:39:48Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gvim-9.2.0398-17.65.1.aarch64",
                "product": {
                  "name": "gvim-9.2.0398-17.65.1.aarch64",
                  "product_id": "gvim-9.2.0398-17.65.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-9.2.0398-17.65.1.aarch64",
                "product": {
                  "name": "vim-9.2.0398-17.65.1.aarch64",
                  "product_id": "vim-9.2.0398-17.65.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-small-9.2.0398-17.65.1.aarch64",
                "product": {
                  "name": "vim-small-9.2.0398-17.65.1.aarch64",
                  "product_id": "vim-small-9.2.0398-17.65.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gvim-9.2.0398-17.65.1.i586",
                "product": {
                  "name": "gvim-9.2.0398-17.65.1.i586",
                  "product_id": "gvim-9.2.0398-17.65.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "vim-9.2.0398-17.65.1.i586",
                "product": {
                  "name": "vim-9.2.0398-17.65.1.i586",
                  "product_id": "vim-9.2.0398-17.65.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "vim-small-9.2.0398-17.65.1.i586",
                "product": {
                  "name": "vim-small-9.2.0398-17.65.1.i586",
                  "product_id": "vim-small-9.2.0398-17.65.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-data-9.2.0398-17.65.1.noarch",
                "product": {
                  "name": "vim-data-9.2.0398-17.65.1.noarch",
                  "product_id": "vim-data-9.2.0398-17.65.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "vim-data-common-9.2.0398-17.65.1.noarch",
                "product": {
                  "name": "vim-data-common-9.2.0398-17.65.1.noarch",
                  "product_id": "vim-data-common-9.2.0398-17.65.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gvim-9.2.0398-17.65.1.ppc64le",
                "product": {
                  "name": "gvim-9.2.0398-17.65.1.ppc64le",
                  "product_id": "gvim-9.2.0398-17.65.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "vim-9.2.0398-17.65.1.ppc64le",
                "product": {
                  "name": "vim-9.2.0398-17.65.1.ppc64le",
                  "product_id": "vim-9.2.0398-17.65.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "vim-small-9.2.0398-17.65.1.ppc64le",
                "product": {
                  "name": "vim-small-9.2.0398-17.65.1.ppc64le",
                  "product_id": "vim-small-9.2.0398-17.65.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gvim-9.2.0398-17.65.1.s390",
                "product": {
                  "name": "gvim-9.2.0398-17.65.1.s390",
                  "product_id": "gvim-9.2.0398-17.65.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "vim-9.2.0398-17.65.1.s390",
                "product": {
                  "name": "vim-9.2.0398-17.65.1.s390",
                  "product_id": "vim-9.2.0398-17.65.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "vim-small-9.2.0398-17.65.1.s390",
                "product": {
                  "name": "vim-small-9.2.0398-17.65.1.s390",
                  "product_id": "vim-small-9.2.0398-17.65.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gvim-9.2.0398-17.65.1.s390x",
                "product": {
                  "name": "gvim-9.2.0398-17.65.1.s390x",
                  "product_id": "gvim-9.2.0398-17.65.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "vim-9.2.0398-17.65.1.s390x",
                "product": {
                  "name": "vim-9.2.0398-17.65.1.s390x",
                  "product_id": "vim-9.2.0398-17.65.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "vim-small-9.2.0398-17.65.1.s390x",
                "product": {
                  "name": "vim-small-9.2.0398-17.65.1.s390x",
                  "product_id": "vim-small-9.2.0398-17.65.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gvim-9.2.0398-17.65.1.x86_64",
                "product": {
                  "name": "gvim-9.2.0398-17.65.1.x86_64",
                  "product_id": "gvim-9.2.0398-17.65.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-9.2.0398-17.65.1.x86_64",
                "product": {
                  "name": "vim-9.2.0398-17.65.1.x86_64",
                  "product_id": "vim-9.2.0398-17.65.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "vim-small-9.2.0398-17.65.1.x86_64",
                "product": {
                  "name": "vim-small-9.2.0398-17.65.1.x86_64",
                  "product_id": "vim-small-9.2.0398-17.65.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss-extended-security:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gvim-9.2.0398-17.65.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gvim-9.2.0398-17.65.1.x86_64"
        },
        "product_reference": "gvim-9.2.0398-17.65.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-9.2.0398-17.65.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-9.2.0398-17.65.1.x86_64"
        },
        "product_reference": "vim-9.2.0398-17.65.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-9.2.0398-17.65.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-data-9.2.0398-17.65.1.noarch"
        },
        "product_reference": "vim-data-9.2.0398-17.65.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-data-common-9.2.0398-17.65.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-data-common-9.2.0398-17.65.1.noarch"
        },
        "product_reference": "vim-data-common-9.2.0398-17.65.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-39881",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39881"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim\u0027s netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gvim-9.2.0398-17.65.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-9.2.0398-17.65.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-data-9.2.0398-17.65.1.noarch",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-data-common-9.2.0398-17.65.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39881",
          "url": "https://www.suse.com/security/cve/CVE-2026-39881"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261833 for CVE-2026-39881",
          "url": "https://bugzilla.suse.com/1261833"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gvim-9.2.0398-17.65.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-9.2.0398-17.65.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-data-9.2.0398-17.65.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-data-common-9.2.0398-17.65.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gvim-9.2.0398-17.65.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-9.2.0398-17.65.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-data-9.2.0398-17.65.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:vim-data-common-9.2.0398-17.65.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-08T10:39:48Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-39881"
    }
  ]
}

CVE-2026-39881 (GCVE-0-2026-39881)

Vulnerability from cvelistv5 – Published: 2026-04-08 20:18 – Updated: 2026-04-09 13:50

Title

Vim Ex command injection in Vims NetBeans integration

Summary

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/7ab76a86048ed49…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0316	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0316

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39881",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T13:50:15.915453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-09T13:50:24.001Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0316"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim\u0027s netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T20:18:19.774Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6"
        },
        {
          "name": "https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0316",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0316"
        }
      ],
      "source": {
        "advisory": "GHSA-mr87-rhgv-7pw6",
        "discovery": "UNKNOWN"
      },
      "title": "Vim Ex command injection in Vims NetBeans integration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-39881",
    "datePublished": "2026-04-08T20:18:19.774Z",
    "dateReserved": "2026-04-07T20:32:03.010Z",
    "dateUpdated": "2026-04-09T13:50:24.001Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2026:1764-1

CVE-2026-39881 (GCVE-0-2026-39881)

Tags

Sightings

Nomenclature