CVE-2026-28422

Low · 2.2

CVSS

2.2

EPSS

0.1%

Published

Feb 27, 2026

CISA due date

—

The record

Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.

Affected packages

Ecosystem	Package	Fixed
Mageia:9	vim	9.2.106-1.mga9
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	vim	9.2.0110-150500.20.43.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	vim	9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Micro 5.5	vim	9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Module for Basesystem 15 SP7	vim	9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7	vim	9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Server 15 SP5-LTSS	vim	9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Server 15 SP6-LTSS	vim	9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5	vim	9.2.0110-150500.20.43.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6	vim	9.2.0110-150500.20.43.1
openSUSE:Leap 15.6	vim	9.2.0110-150500.20.43.1

Related vulnerabilities

CVE-2026-28418 Vim is an open source, command line text editor. Also affects vim
CVE-2026-28419 Vim is an open source, command line text editor. Also affects vim
CVE-2026-28421 Vim is an open source, command line text editor. Also affects vim
CVE-2026-28420 Vim is an open source, command line text editor. Also affects vim
CVE-2026-28417 Vim is an open source, command line text editor. Also affects vim
CVE-2026-26269 Vim is an open source, command line text editor. Also affects vim
CVE-2025-29768 Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted… Also affects vim
CVE-2025-27423 Vim is an open source, command line text editor. Also affects vim