CVE-2026-73071: Vim Use-After-Free Vulnerability

CVE-2026-73071 Overview

CVE-2026-73071 is a use-after-free vulnerability [CWE-416] in Vim, the open source command line text editor. The flaw exists in the json_decode_item() function inside src/json.c and affects Vim versions from 9.2.0511 through 9.2.0843. When json_decode_string() invokes channel_fill() to refill and free the current buffer, json_decode_item() retains a stale pointer. The error path then reads freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. The issue is fixed in Vim 9.2.0844.

Critical Impact
A local attacker who can supply crafted JSON input to Vim's decoder can trigger a read of freed heap memory, potentially causing process crashes or limited information exposure.

Affected Products

Vim 9.2.0511 through 9.2.0843
Fixed in Vim 9.2.0844
Distributions and packages bundling vulnerable Vim builds

Discovery Timeline

2026-08-11 - CVE-2026-73071 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73071

Vulnerability Analysis

The defect resides in Vim's JSON decoder in src/json.c. The function json_decode_item() holds a local pointer p that references data inside the reader's active buffer. During parsing of a JSON string that spans buffer boundaries, json_decode_string() calls channel_fill() to load additional input. That refill can free the buffer that p points into, leaving p as a dangling pointer.

When decoding subsequently fails, the error path passes p to semsg() to format the error message e_json_decode_error_at_str. This dereferences memory that has already been released to the allocator, producing a use-after-free read. The consequences include unstable behavior, denial of service through crashes, and the possibility of leaking arbitrary heap contents that occupy the freed region.

Root Cause

The root cause is a lifetime mismatch between the local pointer p and the underlying reader buffer. The decoder assumed the buffer would remain valid across the parsing call, but channel_fill() can reallocate or free that memory. The fix reports the error position from the current reader state (reader->js_buf + reader->js_used) rather than a pointer that may reference a freed buffer.

Attack Vector

Exploitation requires local access and the ability to feed crafted JSON to Vim's decoder, for example through a channel, plugin, or scripted invocation of json_decode(). No user interaction beyond triggering the decode operation is required, and the attacker needs low privileges. The impact is limited to availability, with no direct integrity or confidentiality loss reported.

// Patch from src/json.c - Vim 9.2.0844
// Fix: report the error position from the current reader instead
// of a stale pointer that may reference freed buffer memory.
 	res->v_type = VAR_SPECIAL;
 	res->vval.v_number = VVAL_NONE;
     }
-    semsg(_(e_json_decode_error_at_str), p);
+    // "p" may dangle into a buffer freed by a js_fill() refill in
+    // json_decode_string(); report the position from the current reader.
+    semsg(_(e_json_decode_error_at_str), reader->js_buf + reader->js_used);

theend:
    for (i = 0; i < stack.ga_len; i++)

Source: GitHub Commit f8126294

Detection Methods for CVE-2026-73071

Indicators of Compromise

Unexpected Vim process crashes or aborts when opening or scripting JSON input
Address sanitizer or heap corruption diagnostics referencing json_decode_item or json_decode_string in src/json.c
Garbled or truncated JSON decode error messages containing non-printable bytes

Detection Strategies

Inventory installed Vim versions and flag any build in the range 9.2.0511 through 9.2.0843
Review scripts, plugins, and channel integrations that call json_decode() on untrusted input
Build debug images of Vim with AddressSanitizer to reproduce and confirm the use-after-free path

Monitoring Recommendations

Collect crash telemetry from developer and analyst workstations where Vim is used with JSON channels
Alert on repeated abnormal terminations of vim or nvim processes correlated with JSON parsing workflows
Track package manager events that install or downgrade Vim to affected versions

How to Mitigate CVE-2026-73071

Immediate Actions Required

Upgrade Vim to version 9.2.0844 or later on all systems
Audit plugins and Vim script code that decode JSON from untrusted or externally sourced data
Restrict execution of Vim against attacker-controlled JSON channels until patching is complete

Patch Information

The fix is included in Vim patch 9.2.0844. It replaces the dangling pointer p with reader->js_buf + reader->js_used in the error reporting path so the decoder never dereferences freed buffer memory. See the GitHub Security Advisory GHSA-69ch-22ch-r887, the Vim 9.2.0844 Release Notes, and the upstream commit for full details.

Workarounds

Avoid invoking json_decode() on untrusted input until the patched Vim build is deployed
Disable or sandbox Vim channels and plugins that stream JSON from external processes
Use distribution package updates that backport the 9.2.0844 fix where a full upstream upgrade is not immediately feasible

bash

# Verify installed Vim version and confirm the fix is present
vim --version | head -n 2

# Example: upgrade using common package managers
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade vim

# Fedora/RHEL
sudo dnf upgrade vim-enhanced

# macOS (Homebrew)
brew update && brew upgrade vim

# Confirm patch 844 is included
vim --version | grep -Eo 'Included patches:.*' | head -n 1