CVE-2026-73070: Vim Text Editor DoS Vulnerability

CVE-2026-73070 Overview

CVE-2026-73070 is a stack buffer overflow [CWE-121] in the Vim text editor's socket server backend. The flaw affects versions prior to 9.2.0842. The socketserver_accept() function in src/socketserver.c accepts unbounded client connections. Those descriptors overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c. A local process that can connect to the Vim server socket can corrupt stack memory or terminate the Vim server process. The issue is fixed in Vim 9.2.0842.

Critical Impact
A local attacker able to reach the Vim server socket can overflow stack-resident file descriptor structures, causing memory corruption or a denial of service against the Vim process.

Affected Products

Vim versions prior to 9.2.0842
Vim builds compiled with socket server support (src/socketserver.c)
Unix-like Vim builds using poll() in src/os_unix.c or select()-based fd_set handling in src/channel.c

Discovery Timeline

2026-08-11 - CVE-2026-73070 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73070

Vulnerability Analysis

The vulnerability lives in Vim's socket server backend, which accepts client connections through socketserver_accept(). The accept path does not cap the number of concurrent client descriptors it hands off to the channel subsystem. Downstream code in src/channel.c inserts these descriptors into fd_set structures. fd_set is bounded by FD_SETSIZE and cannot represent descriptors above that limit. Using FD_SET with an out-of-range descriptor writes past the end of the bitmap, corrupting adjacent stack memory. A parallel bug exists in src/os_unix.c, where a fixed-size struct pollfd fds[7 + 3 * MAX_OPEN_CHANNELS] array is populated for poll(). Additional client channels overflow this stack array. The result is stack memory corruption or termination of the Vim server.

Root Cause

The root cause is missing bounds enforcement between the socket accept loop and the downstream I/O multiplexing structures. socketserver_accept() treats client capacity as unbounded. fd_set and the local pollfd array are both fixed-size stack allocations. Neither call site validated descriptor counts or values before writing to them.

Attack Vector

Exploitation requires local access with permission to connect to the Vim server socket. The attacker opens client connections repeatedly until descriptors exceed FD_SETSIZE or exhaust the pollfd array. Each excess connection writes attacker-influenced descriptor values into stack memory. No user interaction on the Vim server side is required.

// Patch excerpt from src/channel.c - bounds check added before FD_SET
	chanpart_T  *in_part = &ch->ch_part[PART_IN];

	if (in_part->ch_fd != INVALID_FD
# ifdef FD_SETSIZE
		&& (int)in_part->ch_fd < FD_SETSIZE
# endif
		&& is_channel_write_remaining(in_part))
	{
	    FD_SET((int)in_part->ch_fd, wfds);

Source: Vim commit 5598618b

// Patch excerpt from src/os_unix.c - pollfd array resized for client channels
# endif
# ifndef HAVE_SELECT
			// each channel may use in, out and err
-	struct pollfd   fds[7 + 3 * MAX_OPEN_CHANNELS];
+	struct pollfd   fds[7 + 3 * MAX_OPEN_CHANNELS + 2 * MAX_CLIENT_CHANNELS];
	int		nfd;
#  ifdef FEAT_WAYLAND_CLIPBOARD
	int             wayland_idx = -1;

Source: Vim commit 5598618b

Detection Methods for CVE-2026-73070

Indicators of Compromise

Unexpected crashes or SIGSEGV terminations of Vim processes running in server mode
High counts of concurrent local client connections to a Vim server socket from a single user or process
Core dumps referencing socketserver_accept, channel_select_check, or mch_inchar in the call stack

Detection Strategies

Query package inventory for Vim versions below 9.2.0842 on systems where users run vim --servername or otherwise enable the socket server
Alert on repeated connect() system calls to Vim server sockets from processes other than the Vim owner
Correlate Vim process crashes with preceding bursts of local socket activity attributable to the same user session

Monitoring Recommendations

Enable auditd rules for connect() syscalls targeting Unix domain sockets in user runtime directories
Ship crash telemetry (coredumpctl, systemd-coredump) to a central log store and flag Vim crashes
Track Vim version drift across managed endpoints and multi-user hosts

How to Mitigate CVE-2026-73070

Immediate Actions Required

Upgrade Vim to version 9.2.0842 or later on all systems, prioritizing shared multi-user hosts
Audit which builds of Vim on your fleet compile the socket server backend and treat those as higher priority
Restrict local access on shared systems so untrusted users cannot connect to another user's Vim server socket

Patch Information

The fix is delivered in Vim 9.2.0842. The patch adds an FD_SETSIZE bounds check before every FD_SET call in src/channel.c and enlarges the stack pollfd array in src/os_unix.c by 2 * MAX_CLIENT_CHANNELS entries. See the GitHub Security Advisory GHSA-49m8-wwxj-mr69 and the Vim 9.2.0842 release notes for full details.

Workarounds

Avoid launching Vim with --servername or any option that enables the socket server backend until patched
Set filesystem permissions on user runtime directories so only the owning user can connect to the Vim server socket
Rebuild Vim from source without socket server support where the feature is not required

bash

# Verify installed Vim version and confirm the fix is applied
vim --version | head -n 1
# Expect: VIM - Vi IMproved 9.2 (with patch 842 or higher)

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade vim vim-common vim-runtime

# RHEL/Fedora
sudo dnf upgrade vim-enhanced vim-common vim-minimal