{
  "schema_version": "1.7.0",
  "id": "MGASA-2026-0355",
  "published": "2026-09-01T03:06:53Z",
  "modified": "2026-09-01T01:50:48Z",
  "summary": "Updated vim packages fix security vulnerabilities",
  "details": "Arbitrary Code Execution via Shell Keyword Lookup in Vim < 9.2.0839.\n(CVE-2026-73077)\nArbitrary Code Execution via Netrw Menu Construction in Vim < 9.2.0840.\n(CVE-2026-73078)\nHeap Buffer Overflow in Text Property Handling in Vim < 9.2.0841.\n(CVE-2026-73074)\nStack Buffer Overflow in the Vim Socket Server in Vim < 9.2.0842.\n(CVE-2026-73070)\nOut-of-bounds Access in Popup Opacity Handling in Vim >= 9.2.0469 && Vim\n< 9.2.0843. (CVE-2026-73075)\nUse-after-free in JSON Decoding in Vim >= 9.2.0511 && Vim < 9.2.0844.\n(CVE-2026-73071)\nArbitrary Ex Command Execution in C Omni-Completion in Vim < 9.2.0845.\n(CVE-2026-73073)\nHeap Buffer Overflow when Loading a Spell File in Vim < 9.2.0846.\n(CVE-2026-73072)\nArbitrary Command Execution via Malicious `.VimballRecord` Entry Replay\nin `vimball.vim`. (CVE-2026-73076)\n",
  "upstream": [
    "CVE-2026-73077",
    "CVE-2026-73078",
    "CVE-2026-73074",
    "CVE-2026-73070",
    "CVE-2026-73075",
    "CVE-2026-73071",
    "CVE-2026-73073",
    "CVE-2026-73072",
    "CVE-2026-73076"
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2026-0355.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=36127"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/07/24/17"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/07/24/18"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/07/24/19"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/07/24/20"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/07/24/21"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/07/24/28"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/07/24/29"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/07/24/30"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/07/24/31"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vim/vim/security/advisories/GHSA-49m8-wwxj-mr69"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vim/vim/security/advisories/GHSA-pmvp-6rcj-98p4"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vim/vim/security/advisories/GHSA-69ch-22ch-r887"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5g"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/08/25/8"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/vim/vim/security/advisories/GHSA-r77m-8m55-rpr6"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "vim",
        "purl": "pkg:rpm/mageia/vim?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.2.1011-2.mga10"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    },
    {
      "package": {
        "ecosystem": "Mageia:9",
        "name": "vim",
        "purl": "pkg:rpm/mageia/vim?arch=source&distro=mageia-9"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.2.1011-2.mga9"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}