VULNERABILITY INTELLIGENCE
CVE-2026-34714
CVSS score9.2 CRITICAL
EPSS probability0.60%
CISA KEVNot currently listed
Published2026-03-30
Last modified2026-09-01
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Description
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
Weakness classification
- cve@mitre.org: CWE-78
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-917
Primary references
- cve@mitre.org — Patch
- cve@mitre.org — Release Notes
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Mailing List
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c