CVE-2026-34714: Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
Overview
- Severity
- Critical (CVSS 9.2)
- CVSS Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L/E:U
- Exploit Status
- Not Exploited
- Patch Tuesday
- 2026-Mar
- Released
- 2026-04-01
- Last Updated
- 2026-09-25
Affected Products (3)
Other
- 21163-17086
- 21163-21692
- 21147-17084
Revision History
- 2026-04-01: Information published.
- 2026-04-02: Information published.
- 2026-04-08: Information published.
- 2026-09-25: Information published.