Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.

A flaw was found in Vim, an open source command-line text editor. When opening a specially crafted encrypted file using the VimCrypt~04! or VimCrypt~05! methods, an attacker could trigger an unsigned length calculation error. This issue leads to an out-of-bounds read, causing Vim to crash and resulting in a denial of service.

This Moderate impact vulnerability in Vim arises from an out-of-bounds read when processing a specially crafted libsodium-encrypted file. If a user opens a malicious file encrypted with VimCrypt~04! or VimCrypt~05! and the file body is shorter than a single libsodium secretstream header, Vim may crash. This issue requires user interaction to open a malformed file and the +sodium feature to be enabled, limiting its exploitability in typical Red Hat environments. Ensure the spell checker is turned off by running :set nospell within Vim. Do not open untrusted or suspicious files—particularly those encrypted with libsodium methods (VimCrypt~04! or VimCrypt~05!)—within the Vim editor. This prevents the execution of the vulnerable decryption routine Red Hat Hardened Images 2026-06-26T00:00:00Z RHSA-2026:30267 vim-main-9.2.725-1.hum1 Red Hat Enterprise Linux 10 Fix deferred vim Red Hat Enterprise Linux 6 Out of support scope vim Red Hat Enterprise Linux 7 Out of support scope vim Red Hat Enterprise Linux 8 Fix deferred vim Red Hat Enterprise Linux 9 Fix deferred vim Red Hat OpenShift Container Platform 4 Fix deferred rhcos https://www.cve.org/CVERecord?id=CVE-2026-57452 https://nvd.nist.gov/vuln/detail/CVE-2026-57452 https://github.com/vim/vim/commit/c8777cec25dcfae89c42e9aff51af61f71c5745f https://github.com/vim/vim/releases/tag/v9.2.0671 https://github.com/vim/vim/security/advisories/GHSA-c4j9-wr9j-4486