According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When     adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the     buffer that was just opened is closed (including the window where it is shown), this causes the window     structure to be freed which contains a reference to the argument list that we are actually modifying. Once     the autocommands are completed, the references to the window and argument list are no longer valid and as     such cause an use-after-free. Impact is low since the user must either intentionally add some unusual     autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but     it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.(CVE-2024-43374)

    Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the     current position in the typeahead buffer but does not check whether there is enough space left in the     buffer to handle the next characters.  So this may lead to the tb_off position within the typebuf variable     to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g.
    ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before     advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet,     what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to     flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the     off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to     have several mappings active and run into some error condition. But when this happens, this will cause a     crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no     known workarounds for this issue.(CVE-2024-43802)

    Vim is an open source, command line text editor. A use-after-free was found in Vim  9.1.0764. When     closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto     command happens to re-open the same buffer in a new split window. Impact is low since the user must have     intentionally set up such a strange auto command and run some buffer unload commands. However this may     lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade.
    There are no known workarounds for this vulnerability.(CVE-2024-47814)

    When switching to other buffers using the :all command and visual mode still being active, this may cause     a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access     beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before     opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try     to access a position if the position is greater than the corresponding buffer line. Impact is medium since     the user must have switched on visual mode when executing the :all ex command. The Vim project would like     to thank github user gandalf4a for reporting this issue. (CVE-2025-22134)

    Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In     silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode.
    However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim     by feeding some binary characters to Vim. The function that handles the scrolling however may be     triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been     allocated (since there is no screen). (CVE-2025-24014)

    A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects     unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It     is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this     issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade     the affected component.(CVE-2025-1215)

    Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in     versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with     Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch     v9.1.1198.(CVE-2025-29768)

    Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages     using the `:redir` ex command to register, variables and files. It also allows to show the contents of     registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a     register, Vim will free the register content before storing the new content in the register. Now when     redirecting the `:display` command to a register that is being displayed, Vim will free the content while     shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the     ex_display() function, that it does not try to redirect to a register while displaying this register at     the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers     (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will     fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero     when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no     known workarounds for this vulnerability.(CVE-2025-26603)

    Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in     Vims zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip     archives. Impact is low because this exploit requires direct user interaction. However, successfully     exploitation can lead to overwriting sensitive files or placing executable code in privileged locations,     depending on the permissions of the process editing the archive. The victim must edit such a file using     Vim which will reveal the filename and the file content, a careful user may suspect some strange things     going on. Successful exploitation could results in the ability to execute arbitrary commands on the     underlying operating system. Version 9.1.1551 contains a patch for the vulnerability.(CVE-2025-53906)

    Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in     Vims tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar     archives. Impact is low because this exploit requires direct user interaction. However, successfully     exploitation can lead to overwriting sensitive files or placing executable code in privileged locations,     depending on the permissions of the process editing the archive. The victim must edit such a file using     Vim which will reveal the filename and the file content, a careful user may suspect some strange things     going on. Successful exploitation could results in the ability to execute arbitrary commands on the     underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.(CVE-2025-53905)

    Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability     exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that     enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src     etbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with     no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The     issue has been fixed as of Vim patch v9.1.2148.(CVE-2026-26269)

    Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow     vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The     vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim     copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes     (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been     patched in version 9.1.2132.(CVE-2026-25749)

    Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow     out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags     file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074     fixes the issue.(CVE-2026-28418)

    Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in     Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`,     `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be     executed. Additionally, the `mapset()` function lacks a `check_secure()` call, allowing it to be abused     from sandboxed expressions. Commit 9.2.0276 fixes the issue.(CVE-2026-34982)

    Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection     vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n)     in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This     vulnerability depends on the user's 'shell' setting. This issue has been patched in version     9.2.0202.(CVE-2026-33412)

    Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in     Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim     connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This     vulnerability is fixed in 9.2.0316.(CVE-2026-39881)

    Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection     vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted     URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the     privileges of the Vim process. Version 9.2.0073 fixes the issue.(CVE-2026-28417)

    Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's     zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives,     circumventing the previous fix for CVE-2025-53906. This vulnerability is fixed in     9.2.0280.(CVE-2026-35177)

    Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow     exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a     delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated     buffer. Version 9.2.0075 fixes the issue.(CVE-2026-28419)

    Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow     WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining     characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.(CVE-2026-28420)

    Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow     and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated     fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the     issue.(CVE-2026-28421)

    Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs     in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide     terminal. Version 9.2.0078 patches the issue.(CVE-2026-28422)

    Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection     vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt etrw/autoload     etrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name     derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping     embedded single quotes, allowing a crafted directory name to break out of the string context and execute     arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is     sourced. This issue has been patched in version 9.2.0495.(CVE-2026-47162)

    Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection     vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted     URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell     commands with the privileges of the Vim process. This issue has been patched in version     9.2.0383.(CVE-2026-42307)

    Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection     vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-     enclosed shell commands, those commands are executed during file name completion. Because the path option     lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of     a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find     completion. This issue has been patched in version 9.2.0435.(CVE-2026-44656)

    Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists     in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active.
    An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer     multiplication, causing a small buffer to be allocated for a write loop that runs many iterations,     overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can     trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has     been patched in version 9.2.0450.(CVE-2026-45130)

    Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability     exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like     systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the     {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute     shell commands in the user's context. This vulnerability is fixed in 9.2.0479.(CVE-2026-46483)

    Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability     exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed     through wildcard expansion to resolve environment variables and wildcards. If the filename field contains     backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full     privileges of the running user.(CVE-2026-41411)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization vim security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0723-1 advisory.

    Update to version 9.1.1101:

    - CVE-2024-43790: possible out-of-bounds read when performing a search command (bsc#1229685).
    - CVE-2024-43802: heap buffer overflow due to incorrect flushing of the typeahead buffer (bsc#1229822).
    - CVE-2024-45306: heap buffer overflow when cursor position is invalid (bsc#1230078).
    - CVE-2025-22134: heap buffer overflow when switching to other buffers using the :all command with active     visual mode       (bsc#1235695).
    - CVE-2025-24014: NULL pointer dereference may lead to segmentation fault when in silent Ex mode     (bsc#1236151).
    - CVE-2025-1215: memory corruption when manipulating the --log argument (bsc#1237137).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    When switching to other buffers using the :all command and visual mode still being active, this may cause     a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access     beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before     opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try     to access a position if the position is greater than the corresponding buffer line. Impact is medium since     the user must have switched on visual mode when executing the :all ex command. The Vim project would like     to thank github user gandalf4a for reporting this issue.(CVE-2025-22134)

    Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In     silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode.
    However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim     by feeding some binary characters to Vim. The function that handles the scrolling however may be     triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been     allocated (since there is no screen).(CVE-2025-24014)

    A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects     unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It     is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this     issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade     the affected component.(CVE-2025-1215)

Tenable has extracted the preceding description block directly from the EulerOS vim security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in     Vims tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar     archives. Impact is low because this exploit requires direct user interaction. However, successfully     exploitation can lead to overwriting sensitive files or placing executable code in privileged locations,     depending on the permissions of the process editing the archive. The victim must edit such a file using     Vim which will reveal the filename and the file content, a careful user may suspect some strange things     going on. Successful exploitation could results in the ability to execute arbitrary commands on the     underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.(CVE-2025-53905)

    Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in     Vims zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip     archives. Impact is low because this exploit requires direct user interaction. However, successfully     exploitation can lead to overwriting sensitive files or placing executable code in privileged locations,     depending on the permissions of the process editing the archive. The victim must edit such a file using     Vim which will reveal the filename and the file content, a careful user may suspect some strange things     going on. Successful exploitation could results in the ability to execute arbitrary commands on the     underlying operating system. Version 9.1.1551 contains a patch for the vulnerability.(CVE-2025-53906)

    When switching to other buffers using the :all command and visual mode still being active, this may cause     a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access     beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before     opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try     to access a position if the position is greater than the corresponding buffer line. Impact is medium since     the user must have switched on visual mode when executing the :all ex command. The Vim project would like     to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch     v9.1.1003(CVE-2025-22134)

    Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In     silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode.
    However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim     by feeding some binary characters to Vim. The function that handles the scrolling however may be     triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been     allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.(CVE-2025-24014)

    A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects     unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It     is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this     issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade     the affected component.(CVE-2025-1215)

    Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in     versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with     Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch     v9.1.1198.(CVE-2025-29768)

    Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages     using the `:redir` ex command to register, variables and files. It also allows to show the contents of     registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a     register, Vim will free the register content before storing the new content in the register. Now when     redirecting the `:display` command to a register that is being displayed, Vim will free the content while     shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the     ex_display() function, that it does not try to redirect to a register while displaying this register at     the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers     (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will     fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero     when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no     known workarounds for this vulnerability.(CVE-2025-26603)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization vim security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1584 advisory.

    When switching to other buffers using the :all command and visual mode still being active, this may cause     a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access     beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before     opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try     to access a position if the position is greater than the corresponding buffer line. Impact is medium since     the user must have switched on visual mode when executing the :all ex command. The Vim project would like     to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch     v9.1.1003 (CVE-2025-22134)

    A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of     the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be     performed locally. The exploit is publicly available and might be used. Some users are not able to     reproduce this. One of the users mentions that this appears not to be working, when coloring is turned     on. (CVE-2025-9389)

    A security flaw has been discovered in vim up to 9.1.1615. Affected by this vulnerability is the function     main of the file src/xxd/xxd.c of the component xxd. The manipulation results in buffer overflow. The     attack requires a local approach. The exploit has been released to the public and may be exploited.
    Upgrading to version 9.1.1616 addresses this issue. The patch is identified as     eeef7c77436a78cd27047b0f5fa6925d56de3cb0. It is recommended to upgrade the affected component.
    (CVE-2025-9390)

    Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow     vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The     vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim     copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes     (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been     patched in version 9.1.2132. (CVE-2026-25749)

    Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability     exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that     enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in     src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf)     with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command.
    The issue has been fixed as of Vim patch v9.1.2148. (CVE-2026-26269)

    Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection     vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted     URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the     privileges of the Vim process. Version 9.2.0073 fixes the issue. (CVE-2026-28417)

    Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow     out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags     file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074     fixes the issue. (CVE-2026-28418)

    Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow     exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a     delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated     buffer. Version 9.2.0075 fixes the issue. (CVE-2026-28419)

    Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow     WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining     characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue. (CVE-2026-28420)

    Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex     compiler, when encountering a collection containing a combining character as the endpoint of a character     range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states.
    This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When     nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind     assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This     vulnerability is fixed in 9.2.0137. (CVE-2026-32249)

    Command injection via newline in glob()

    NOTE: https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c (CVE-2026-33412)

    Vim before 9.2.0272 allows code execution that happens immediately upo ...

    NOTE: https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvhNOTE: Fixed by:
    https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459 (v9.2.0272) (CVE-2026-34714)

    A modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file.
    The complete, guitabtooltip and printheader options are missing the P_MLE flag, allowing a modeline to be     executed. Additionally, the mapset() function lacks a check_secure() call, allowing it to be abused from     sandboxed expressions.

    An attacker who can deliver a crafted file to a victim achieves arbitrary command execution with the     privileges of the user running Vim. (CVE-2026-34982)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0722-1 advisory.

    Update to version 9.1.1101:

    - CVE-2024-43790: possible out-of-bounds read when performing a search command (bsc#1229685).
    - CVE-2024-43802: heap buffer overflow due to incorrect flushing of the typeahead buffer (bsc#1229822).
    - CVE-2024-45306: heap buffer overflow when cursor position is invalid (bsc#1230078).
    - CVE-2025-22134: heap buffer overflow when switching to other buffers using the :all command with active     visual mode       (bsc#1235695).
    - CVE-2025-24014: NULL pointer dereference may lead to segmentation fault when in silent Ex mode     (bsc#1236151).
    - CVE-2025-1215: memory corruption when manipulating the --log argument (bsc#1237137).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    When switching to other buffers using the :all command and visual mode still being active, this may cause     a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access     beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before     opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try     to access a position if the position is greater than the corresponding buffer line. Impact is medium since     the user must have switched on visual mode when executing the :all ex command. The Vim project would like     to thank github user gandalf4a for reporting this issue. (CVE-2025-22134)

    Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In     silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode.
    However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim     by feeding some binary characters to Vim. The function that handles the scrolling however may be     triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been     allocated (since there is no screen). (CVE-2025-24014)

Tenable has extracted the preceding description block directly from the EulerOS vim security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the vim package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When switching to other buffers using the :all command and visual mode still being active, this may cause     a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access     beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before     opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try     to access a position if the position is greater than the corresponding buffer line. Impact is medium since     the user must have switched on visual mode when executing the :all ex command. The Vim project would like     to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch     v9.1.1003 (CVE-2025-22134)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006151 advisory.

    When switching to other buffers using the :all command and visual mode still being active, this may cause     a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access     beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before     opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try     to access a position if the position is greater than the corresponding buffer line. Impact is medium since     the user must have switched on visual mode when executing the :all ex command. The Vim project would like     to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch     v9.1.1003

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-22134 advisory.

  - When switching to other buffers using the :all command and visual mode still being active, this May cause     a heap-buffer overflow, because Vim does not properly end visual mode and therefore May try to access     beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before     opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try     to access a position if the position is greater than the corresponding buffer line. Impact is medium since     the user must have switched on visual mode when executing the :all ex command. The Vim project would like     to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch     v9.1.1003 (CVE-2025-22134)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects     unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It     is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this     issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade     the affected component.(CVE-2025-1215)

    Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In     silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode.
    However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim     by feeding some binary characters to Vim. The function that handles the scrolling however may be     triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been     allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.(CVE-2025-24014)

    When switching to other buffers using the :all command and visual mode still being active, this may cause     a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access     beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before     opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try     to access a position if the position is greater than the corresponding buffer line. Impact is medium since     the user must have switched on visual mode when executing the :all ex command. The Vim project would like     to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch     v9.1.1003(CVE-2025-22134)

Tenable has extracted the preceding description block directly from the EulerOS vim security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1767712744 advisory.

  - When switching to other buffers using the :all command and visual mode still being active, this may cause     a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access     beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before     opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try     to access a position if the position is greater than the corresponding buffer line. Impact is medium since     the user must have switched on visual mode when executing the :all ex command. The Vim project would like     to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch     v9.1.1003 (CVE-2025-22134)

  - Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In     silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode.
    However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim     by feeding some binary characters to Vim. The function that handles the scrolling however may be     triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been     allocated (since there is no screen). This vulnerability is fixed in 9.1.1043. (CVE-2025-24014)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
348021	EulerOS Virtualization 2.11.1 : vim (EulerOS-SA-2026-3480)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	high
216901	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : vim (SUSE-SU-2025:0723-1)	Nessus	SuSE Local Security Checks	2025/2/27	2025/9/26	low
235743	EulerOS 2.0 SP10 : vim (EulerOS-SA-2025-1542)	Nessus	Huawei Local Security Checks	2025/5/12	2025/5/12	low
297293	EulerOS Virtualization 2.10.0 : vim (EulerOS-SA-2026-1202)	Nessus	Huawei Local Security Checks	2026/1/31	2026/2/3	low
306195	Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-1584)	Nessus	Amazon Linux Local Security Checks	2026/4/13	2026/5/8	medium
216882	SUSE SLES12 Security Update : vim (SUSE-SU-2025:0722-1)	Nessus	SuSE Local Security Checks	2025/2/27	2025/9/26	low
234153	EulerOS 2.0 SP11 : vim (EulerOS-SA-2025-1380)	Nessus	Huawei Local Security Checks	2025/4/11	2025/4/11	medium
235752	EulerOS 2.0 SP10 : vim (EulerOS-SA-2025-1543)	Nessus	Huawei Local Security Checks	2025/5/12	2025/5/12	low
238290	Photon OS 4.0: Vim PHSA-2025-4.0-0812	Nessus	PhotonOS Local Security Checks	2025/6/12	2026/1/21	low
230541	Linux Distros Unpatched Vulnerability : CVE-2025-22134	Nessus	Misc.	2025/3/6	2026/9/2	medium
302316	Unity Linux 20.1070e Security Update: vim (UTSA-2026-006151)	Nessus	Unity Linux Local Security Checks	2026/3/15	2026/3/15	medium
214492	CBL Mariner 2.0 Security Update: vim (CVE-2025-22134)	Nessus	MarinerOS Local Security Checks	2025/1/22	2025/8/15	medium
238187	EulerOS 2.0 SP13 : vim (EulerOS-SA-2025-1626)	Nessus	Huawei Local Security Checks	2025/6/11	2025/6/11	low
360818	Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1767712744)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium

检测

插件搜索

high

low

low

low

medium

low

medium

low

low

medium

medium

medium

low

medium