CVE-2026-34982 — Vim modeline bypass via various options affects Vim < 9.2.0276

Description (CNA)

Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused from sandboxed expressions. Commit 9.2.0276 fixes the issue.

Affected (CNA)

Vendor / product	Versions
vim / vim	affected < 9.2.0276

CWE

CWE-78

References

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/04/01/1

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the `complete`, `guitabtooltip`, `printheader` options and the `mapset` function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution.