CVE-2026-26269CWE-121

Vim has a Netbeans specialKeys Stack Buffer Overflow

Medium · published February 13, 2026

CVSS v3.1
5.4
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00584 · 47.2th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2026-02-13T19:18Z
EPSS history
Timeline
  • 13 FEB 19:18Z
    Vim has a Netbeans specialKeys Stack Buffer Overflow
    cvelistv5