CVE-2026-34714criticalCWE-78 CWE-917

CVE-2026-34714: falha crítica em Vim

Publicada em 30 mar 2026 · Atualizada em 01 set 2026

Seguir esta CVE + Monitorar vim + Monitorar vim

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.6%

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Produtos afetados

Vim · Vim

Referências

https://access.redhat.com/security/cve/CVE-2026-34714 https://bugzilla.redhat.com/show_bug.cgi?id=2453139 https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459 https://github.com/vim/vim/releases/tag/v9.2.0272 https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34714.json https://www.openwall.com/lists/oss-security/2026/03/30/3 http://www.openwall.com/lists/oss-security/2026/04/02/4 http://www.openwall.com/lists/oss-security/2026/04/02/5 http://www.openwall.com/lists/oss-security/2026/04/03/6