CVE-2026-73070 in Vim
Summary
by MITRE • 08/11/2026
Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described represents a critical buffer overflow condition within the Vim text editor's socket server implementation, specifically affecting versions prior to 9.2.0842. This flaw resides in the socketserver_accept() function located in src/socketserver.c which fails to properly limit the number of concurrent client connections that can be accepted by the server backend. The issue stems from the lack of connection rate limiting or descriptor management within the server's acceptance mechanism, allowing malicious local processes to continuously establish connections until system resources are exhausted.
The technical exploitation of this vulnerability occurs through the manipulation of file descriptor structures and polling mechanisms within the Unix operating system environment. When excessive connections are established, the fd_set structures in src/channel.c become corrupted due to overflow conditions, while fixed-size struct pollfd arrays in src/os_unix.c experience similar memory corruption issues. These data structures are fundamental components used by the select() and poll() system calls for managing I/O multiplexing operations, making their corruption particularly dangerous as they directly impact the operating system's ability to manage concurrent processes and network connections effectively.
The operational impact of this vulnerability extends beyond simple denial-of-service conditions, as it provides potential for stack memory corruption that could lead to arbitrary code execution within the Vim server process. Local processes with the ability to connect to the Vim server socket can exploit this weakness to cause unpredictable behavior including crashes, data corruption, or potentially more severe security implications if the memory corruption affects critical program structures or control flow mechanisms. The vulnerability demonstrates poor resource management practices in handling concurrent connection requests and highlights inadequate bounds checking within the socket server implementation.
This vulnerability aligns with CWE-770, which covers allocation of resources without limits or with inadequate limits, specifically manifesting as an insufficient resource pool size in the socket server's connection handling capabilities. The issue also relates to CWE-129, concerning improper validation of array indices, as the fixed-size pollfd arrays and fd_set structures are not properly validated against the actual number of connections being handled. From an attack perspective, this vulnerability maps to ATT&CK technique T1059.006 for Command and Scripting Interpreter: Python, where local processes could be leveraged to exploit the resource exhaustion condition through automated connection attempts.
Mitigation strategies should focus on implementing proper connection rate limiting and descriptor management within the socket server backend to prevent unbounded resource consumption. The most effective solution involves updating to Vim version 9.2.0842 or later, which contains the necessary patches that properly limit concurrent connections and implement robust bounds checking for file descriptor structures. Additionally, system administrators should consider implementing connection limits at the operating system level through ulimit settings or network namespace restrictions to provide additional defense in depth against similar resource exhaustion attacks targeting other applications with similar socket handling patterns.