CVE-2026-73076: Vim Text Editor RCE Vulnerability

CVE-2026-73076 Overview

CVE-2026-73076 is a code injection vulnerability [CWE-94] in Vim, the open source command-line text editor. The flaw resides in runtime/autoload/vimball.vim and affects all versions prior to 9.2.0847. A crafted vimball archive can include a member named .VimballRecord that overwrites Vim's installation record with attacker-chosen Ex commands. When vimball#RmVimball() later processes the matching record entry, the stored commands execute with the privileges of the user running Vim. Because Ex commands include the shell escape :!, this allows arbitrary operating-system command execution. The maintainers fixed the issue in Vim version 9.2.0847.

Critical Impact
Opening or removing a malicious vimball can trigger arbitrary command execution under the current user's account, enabling local code execution and potential lateral compromise of developer workstations.

Affected Products

Vim versions prior to 9.2.0847
runtime/autoload/vimball.vim component
Systems using the Vimball plugin distribution mechanism

Discovery Timeline

2026-08-11 - CVE-2026-73076 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73076

Vulnerability Analysis

Vim's Vimball plugin format bundles scripts and resources into a single archive that can be installed with :UseVimball. During installation, Vim writes an entry to a .VimballRecord file that lists the files created, so :RmVimball can later remove them. The vulnerability arises because a Vimball can itself contain a member named .VimballRecord. When such an archive is processed, the crafted record file overwrites the trusted installation log with attacker-controlled content.

The record file is not a passive manifest. Each entry stores Ex commands that Vim executes during removal. When vimball#RmVimball() reads the poisoned record and dispatches the matching entry, it runs the attacker's Ex commands, including shell escapes via :!. This produces command execution under the current user's account.

Root Cause

The root cause is unsafe trust in an archive-supplied file that Vim treats as an internal control artifact. runtime/autoload/vimball.vim did not validate or reject archive members named .VimballRecord, and it did not sanitize the Ex commands stored in that record before executing them during removal. The design conflates untrusted archive content with trusted local state.

Attack Vector

Exploitation requires a local user to process a malicious vimball, either by installing it with :UseVimball and later removing it, or by triggering vimball#RmVimball() against a repository containing a poisoned .VimballRecord. The attacker must convince the victim to open the crafted file. Execution occurs with the privileges of the Vim user, so targeting administrators or CI accounts escalates impact.

text

" vimball.vim : construct a file containing both paths and files
" Maintainer: This runtime file is looking for a new maintainer.
" Original Author:	Charles E. Campbell
-" Date:			Jun 29, 2026
+" Date:			Jul 23, 2026
" Version:	37 (with modifications from the Vim Project)
" GetLatestVimScripts: 1502 1 :AutoInstall: vimball.vim
" Copyright: (c) 2004-2011 by Charles E. Campbell

Source: GitHub Commit 581a2f3 — patch 9.2.0847 addressing code execution via .VimballRecord in runtime/autoload/vimball.vim.

Detection Methods for CVE-2026-73076

Indicators of Compromise

Presence of a .VimballRecord file inside a downloaded vimball archive or plugin repository from an untrusted source.
Unexpected shell command execution originating from a vim or gvim parent process on developer or build systems.
Modifications to ~/.vim/.VimballRecord or $VIM/vimfiles/.VimballRecord that contain :! shell escapes or unfamiliar Ex commands.

Detection Strategies

Scan filesystems for .VimballRecord files and audit their contents for shell escape sequences and unexpected Ex commands.
Monitor process telemetry for child processes spawned by vim that invoke shells, network utilities, or package managers.
Inspect Vimball archives before installation using unzip-style inspection or :VimballList to enumerate members and reject any containing .VimballRecord.

Monitoring Recommendations

Alert on file writes to .VimballRecord paths outside of legitimate :UseVimball operations.
Track installation and removal of Vim plugins through endpoint telemetry, correlating archive downloads with subsequent process activity.
Maintain an inventory of Vim versions across developer endpoints and build agents to identify hosts running versions prior to 9.2.0847.

How to Mitigate CVE-2026-73076

Immediate Actions Required

Upgrade Vim to version 9.2.0847 or later on all workstations, servers, and container images.
Audit existing .VimballRecord files on user systems and remove or replace any that contain suspicious Ex commands or shell escapes.
Restrict installation of Vimball archives to trusted, signed sources and block download of vimballs from untrusted origins.

Patch Information

The issue is fixed in Vim 9.2.0847. The patch updates runtime/autoload/vimball.vim and increments the patch table in src/version.c. Details are available in the Vim GitHub Security Advisory GHSA-r22p-fhw4-84p2 and the upstream commit 581a2f3. Linux distribution maintainers should apply vendor-provided backports where available.

Workarounds

Avoid using :UseVimball and :RmVimball against archives from untrusted sources until the patched version is deployed.
Preview vimball contents with :VimballList and reject any archive that includes a .VimballRecord member.
Run editor sessions used to inspect untrusted files under a low-privilege account or inside a sandboxed container.

bash

# Verify installed Vim version meets the patched release
vim --version | head -n 2

# Search for suspicious .VimballRecord entries containing shell escapes
grep -RIn --include='.VimballRecord' -e ':!' -e 'system(' ~/.vim /root/.vim 2>/dev/null

# Inspect a vimball before installing it
vim -c 'VimballList suspicious.vba' -c 'q'