Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LSummary
CVE-2026-28419 is a medium-severity Buffer Underflow (CWE-124) vulnerability in Vim Vim. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9087
Vulnerability Data
Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a…
more
line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the vendor patch (9.2.0075) that eliminates the tags-file buffer-underflow.
Integrity verification of the Vim binary can detect execution of an unpatched or tampered version susceptible to the CWE-124/125 flaw.
Regular vulnerability scanning identifies systems running Vim < 9.2.0075 that remain exposed to malformed tags-file parsing.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent introduction of buffer underwrite flaws via coding standards, reviews, and testing.
Vulnerability identification processes can discover buffer underwrite issues but do not prevent their creation.
Patching removes instances of the weakness after discovery but does not address root-cause prevention in code.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches buffer-underflow defects before release.
Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.
Secure SDLC mandates input validation and bounds checking that directly prevent buffer underflow.
Application security requirements can specify buffer-size and pointer-safety rules.
Secure architecture and engineering principles require safe memory-handling patterns.
Secure coding standards explicitly forbid unsafe pointer arithmetic and mandate bounds checks.