Vim up to 9.1.2131 src/tag.c get_tagfname helpfile heap-based overflow

Summaryinfo

A vulnerability classified as critical was found in Vim up to 9.1.2131. This vulnerability affects the function get_tagfname of the file src/tag.c. The manipulation of the argument helpfile results in heap-based overflow. This vulnerability is known as CVE-2026-25749. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in Vim up to 9.1.2131. Affected is the function get_tagfname of the file src/tag.c. The manipulation of the argument helpfile with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-25749 since 02/05/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 298305 (Linux Distros Unpatched Vulnerability : CVE-2026-25749), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.1.2132 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 0714b15940b245108e6e9d7aa2260dd849a26fa9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (298305) and CERT Bund (WID-SEC-2026-0335). Once again VulDB remains the best source for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• Oracle Linux
• RESF Rocky Linux
• Open Source vim
• Red Hat OpenShift

Productinfo

Type

• Word Processing Software

Name

• Vim

Version

• 9.1.2131

License

• open-source

Website

• Product: https://github.com/vim/vim/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion