Cyber Resilience

CVE-2026-57454

Memory Safety in Vim 9.2.0320 – 9.2.0679

Published
25 June 2026
Modified
26 June 2026
Patch / advisory
CVSS Score v4 6.8
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0012 2th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-57454 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Vim Vim. Its CVSS base score is 6.8 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and SI-4 (System Monitoring) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property data. When Vim restores or displays such…

more

a line it converts the offset into a pointer and reads the virtual text without bounds checking, causing an out-of-bounds read that can crash Vim or disclose adjacent heap memory. This vulnerability is fixed in 9.2.0679.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

OOB read triggered by opening attacker-crafted undo/swap file directly maps to malicious file execution by the victim.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-52859Same product: Vim Vim
CVE-2026-57451Same product: Vim Vim
CVE-2026-28418Same product: Vim Vim
CVE-2026-55693Same product: Vim Vim
CVE-2026-28419Same product: Vim Vim
CVE-2026-46483Same product: Vim Vim
CVE-2026-28420Same product: Vim Vim
CVE-2026-35177Same product: Vim Vim
CVE-2026-59858Same product: Vim Vim
CVE-2026-44656Same product: Vim Vim

Affected Assets

vim
vim
9.2.0320 — 9.2.0679

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
  • SI-4 System Monitoring
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely application of the vendor patch that eliminates the out-of-bounds read when processing crafted undo/swap files.

detect

Requires integrity verification of Vim executables and associated undo/swap files, enabling detection of unauthorized or maliciously crafted files before they trigger the CWE-125 flaw.

detect

Provides continuous monitoring of process behavior that can identify crashes or anomalous memory access patterns resulting from exploitation of the virtual-text offset vulnerability.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices such as bounds checking and memory-safe languages directly prevent out-of-bounds reads.

ID.RA-01 partial match
prevents

Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.

PR.PS-02 partial match
prevents

Routine patching replaces vulnerable code containing out-of-bounds read flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development and acceptance includes fuzzing and static analysis that detect out-of-bounds read defects before release.

A.8.15 Logging partial match
detects

Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.

prevents

Secure development life cycle mandates input validation and bounds checking that directly prevent out-of-bounds reads.

prevents

Application security requirements include explicit bounds and memory-safety specifications that mitigate buffer over-reads.

prevents

Secure system architecture and engineering principles require memory-safe design patterns and runtime protections against out-of-bounds access.

prevents

Secure coding standards explicitly forbid unsafe pointer arithmetic and mandate bounds-checked reads, eliminating CWE-125.

References