CVE-2026-73071
Low · 3.3CVSS
3.3
EPSS
0.1%
Published
Aug 11, 2026
CISA due date
—
The record
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-416
- CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-416
- CVE-2026-112402 Pillow is a Python imaging library. CWE-416
- CVE-2026-112396 Pillow is a Python imaging library. CWE-416
- CVE-2025-55654 A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of… CWE-416
- CVE-2026-17591 A flaw was found in libarchive. CWE-416
- CVE-2026-92392 During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with… CWE-416
- CVE-2026-109268 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free… CWE-416