{"schema_version":"1.7.2","id":"OESA-2026-3122","modified":"2026-07-24T03:26:36Z","published":"2026-07-24T03:26:36Z","upstream":["CVE-2026-59856","CVE-2026-59857","CVE-2026-59858"],"summary":"vim security update","details":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.(CVE-2026-59856)\n\nVim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.(CVE-2026-59857)\n\nVim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.(CVE-2026-59858)","affected":[{"package":{"ecosystem":"openEuler:20.03-LTS-SP4","name":"vim","purl":"pkg:rpm/openEuler/vim&distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-53.oe2003sp4"}]}],"ecosystem_specific":{"aarch64":["vim-X11-9.0-53.oe2003sp4.aarch64.rpm","vim-common-9.0-53.oe2003sp4.aarch64.rpm","vim-debuginfo-9.0-53.oe2003sp4.aarch64.rpm","vim-debugsource-9.0-53.oe2003sp4.aarch64.rpm","vim-enhanced-9.0-53.oe2003sp4.aarch64.rpm","vim-minimal-9.0-53.oe2003sp4.aarch64.rpm"],"noarch":["vim-filesystem-9.0-53.oe2003sp4.noarch.rpm"],"src":["vim-9.0-53.oe2003sp4.src.rpm"],"x86_64":["vim-X11-9.0-53.oe2003sp4.x86_64.rpm","vim-common-9.0-53.oe2003sp4.x86_64.rpm","vim-debuginfo-9.0-53.oe2003sp4.x86_64.rpm","vim-debugsource-9.0-53.oe2003sp4.x86_64.rpm","vim-enhanced-9.0-53.oe2003sp4.x86_64.rpm","vim-minimal-9.0-53.oe2003sp4.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"vim","purl":"pkg:rpm/openEuler/vim&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-53.oe2203sp4"}]}],"ecosystem_specific":{"aarch64":["vim-X11-9.0-53.oe2203sp4.aarch64.rpm","vim-common-9.0-53.oe2203sp4.aarch64.rpm","vim-debuginfo-9.0-53.oe2203sp4.aarch64.rpm","vim-debugsource-9.0-53.oe2203sp4.aarch64.rpm","vim-enhanced-9.0-53.oe2203sp4.aarch64.rpm","vim-minimal-9.0-53.oe2203sp4.aarch64.rpm"],"noarch":["vim-filesystem-9.0-53.oe2203sp4.noarch.rpm"],"src":["vim-9.0-53.oe2203sp4.src.rpm"],"x86_64":["vim-X11-9.0-53.oe2203sp4.x86_64.rpm","vim-common-9.0-53.oe2203sp4.x86_64.rpm","vim-debuginfo-9.0-53.oe2203sp4.x86_64.rpm","vim-debugsource-9.0-53.oe2203sp4.x86_64.rpm","vim-enhanced-9.0-53.oe2203sp4.x86_64.rpm","vim-minimal-9.0-53.oe2203sp4.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"vim","purl":"pkg:rpm/openEuler/vim&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-39.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["vim-X11-9.0.2092-39.oe2403sp1.aarch64.rpm","vim-common-9.0.2092-39.oe2403sp1.aarch64.rpm","vim-debuginfo-9.0.2092-39.oe2403sp1.aarch64.rpm","vim-debugsource-9.0.2092-39.oe2403sp1.aarch64.rpm","vim-enhanced-9.0.2092-39.oe2403sp1.aarch64.rpm","vim-minimal-9.0.2092-39.oe2403sp1.aarch64.rpm"],"noarch":["vim-filesystem-9.0.2092-39.oe2403sp1.noarch.rpm"],"src":["vim-9.0.2092-39.oe2403sp1.src.rpm"],"x86_64":["vim-X11-9.0.2092-39.oe2403sp1.x86_64.rpm","vim-common-9.0.2092-39.oe2403sp1.x86_64.rpm","vim-debuginfo-9.0.2092-39.oe2403sp1.x86_64.rpm","vim-debugsource-9.0.2092-39.oe2403sp1.x86_64.rpm","vim-enhanced-9.0.2092-39.oe2403sp1.x86_64.rpm","vim-minimal-9.0.2092-39.oe2403sp1.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP3","name":"vim","purl":"pkg:rpm/openEuler/vim&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-39.oe2403sp3"}]}],"ecosystem_specific":{"aarch64":["vim-X11-9.0.2092-39.oe2403sp3.aarch64.rpm","vim-common-9.0.2092-39.oe2403sp3.aarch64.rpm","vim-debuginfo-9.0.2092-39.oe2403sp3.aarch64.rpm","vim-debugsource-9.0.2092-39.oe2403sp3.aarch64.rpm","vim-enhanced-9.0.2092-39.oe2403sp3.aarch64.rpm","vim-minimal-9.0.2092-39.oe2403sp3.aarch64.rpm"],"noarch":["vim-filesystem-9.0.2092-39.oe2403sp3.noarch.rpm"],"src":["vim-9.0.2092-39.oe2403sp3.src.rpm"],"x86_64":["vim-X11-9.0.2092-39.oe2403sp3.x86_64.rpm","vim-common-9.0.2092-39.oe2403sp3.x86_64.rpm","vim-debuginfo-9.0.2092-39.oe2403sp3.x86_64.rpm","vim-debugsource-9.0.2092-39.oe2403sp3.x86_64.rpm","vim-enhanced-9.0.2092-39.oe2403sp3.x86_64.rpm","vim-minimal-9.0.2092-39.oe2403sp3.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP4","name":"vim","purl":"pkg:rpm/openEuler/vim&distro=openEuler-24.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-39.oe2403sp4"}]}],"ecosystem_specific":{"aarch64":["vim-X11-9.0.2092-39.oe2403sp4.aarch64.rpm","vim-common-9.0.2092-39.oe2403sp4.aarch64.rpm","vim-debuginfo-9.0.2092-39.oe2403sp4.aarch64.rpm","vim-debugsource-9.0.2092-39.oe2403sp4.aarch64.rpm","vim-enhanced-9.0.2092-39.oe2403sp4.aarch64.rpm","vim-minimal-9.0.2092-39.oe2403sp4.aarch64.rpm"],"noarch":["vim-filesystem-9.0.2092-39.oe2403sp4.noarch.rpm"],"src":["vim-9.0.2092-39.oe2403sp4.src.rpm"],"x86_64":["vim-X11-9.0.2092-39.oe2403sp4.x86_64.rpm","vim-common-9.0.2092-39.oe2403sp4.x86_64.rpm","vim-debuginfo-9.0.2092-39.oe2403sp4.x86_64.rpm","vim-debugsource-9.0.2092-39.oe2403sp4.x86_64.rpm","vim-enhanced-9.0.2092-39.oe2403sp4.x86_64.rpm","vim-minimal-9.0.2092-39.oe2403sp4.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3122"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59856"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59857"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59858"}],"database_specific":{"severity":"High"}}