CVE-2026-73071

Published: Aug 11, 2026Modified: Sep 9, 2026

3.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Exploitability: 1.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (3)

https://github.com/vim/vim/commit/f8126294a526aa80c5123eb3079e325daee9ec75

Source: security-advisories@github.com

https://github.com/vim/vim/releases/tag/v9.2.0844

Source: security-advisories@github.com

https://github.com/vim/vim/security/advisories/GHSA-69ch-22ch-r887

Source: security-advisories@github.com

Timeline

No history available yet.