critical advisory March 30, 2026

Vim Code Execution Vulnerability via Crafted Files (CVE-2026-34714)

Vim versions before 9.2.0272 allow code execution upon opening a specially crafted file due to %{expr} injection in tabpanel lacking P_MLE in the default configuration, potentially leading to arbitrary code execution.

Triage facts

Severity: Critical
Sources: 5 public sources
Freshness: PublishedMar 30, 19:16 UTC
Detection: 2 rules

Vim, a widely used text editor, is susceptible to a critical vulnerability (CVE-2026-34714) affecting versions prior to 9.2.0272. This flaw allows for arbitrary code execution simply by opening a malicious file. The vulnerability stems from a %{expr} injection vulnerability within the tabpanel component, specifically when it lacks the P_MLE protection. The default configuration of Vim is susceptible, amplifying the risk. An attacker can craft a Vim file that, when opened, will trigger the…

Detection coverage 2

Detect Suspicious Vim File Open with Expr Injection

critical

Detects attempts to exploit the Vim %{expr} injection vulnerability by monitoring for vim processes opening files with suspicious content.

sigma tactics: execution techniques: T1204.002 sources: process_creation, linux

Detect Execution from Suspicious Vim Process

high

Detects potential code execution originating from a Vim process, indicative of exploitation attempts.

sigma tactics: execution techniques: T1059.004 sources: process_creation, linux

Detection queries are available on the platform. Get full rules →