USN-8541-1: Vim vulnerabilities
Hirohito Higashi discovered that Vim incorrectly escaped class or trait names when performing PHP omni-completion. An attacker could possibly use this issue to trick a user into opening a specially crafted PHP file and executing arbitrary commands. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-59856) Hirohito Higashi discovered that Vim incorrectly handled sound-folding of certain words when using a spell file. An attacker could possibly use this issue to cause Vim to crash, resulting in a denial of service. (CVE-2026-59857) It was discovered that Vim incorrectly escaped certain tags file fields when performing C omni-completion. An attacker could possibly use this issue to trick a user into opening a specially crafted file and executing arbitrary commands. (CVE-2026-59858)
CSIRTS triage
- What
- Vim has multiple vulnerabilities that could allow arbitrary command execution and denial of service.
- Who is affected
- Users of Vim on specified Ubuntu versions are affected.
- Urgency
- The severity is unknown, but users should address these vulnerabilities to maintain security.
- Action
- Users should update Vim to the latest version available.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Vim
Get an email when a new Vim advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://ubuntu.com/security/notices/USN-8541-1
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-598560.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
- Low exploitation riskCVE-2026-598570.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.
- Low exploitation riskCVE-2026-598580.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-59856 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-59857 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-59858 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[UPDATE] [medium] vim: Multiple vulnerabilities allow code executioncert-bund
- medium[UPDATE] [medium] vim: Vulnerability allows Denial of Servicecert-bund
- unknownMultiple vulnerabilities in Microsoft Azure Linux (July 15, 2026)cert-fr-avis
- highCVE-2026-59856: Vim: Arbitrary Code Execution via PHP Omni-Completionmsrc
- highCVE-2026-59858: Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion scri…nvd
- mediumCVE-2026-59857: Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of …nvd
- highCVE-2026-59856: Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion sc…nvd
More from Ubuntu Security Notices
- highUSN-8620-4: Linux kernel (Intel IoTG) vulnerabilities2026-07-31
- highUSN-8620-3: Linux kernel (Intel IoTG) vulnerabilities2026-07-31
- unknownUSN-8625-1: OpenSSL vulnerability2026-07-30
- unknownUSN-8624-1: Sinatra vulnerability2026-07-29
- unknownUSN-8623-1: Linux kernel (NVIDIA) vulnerabilities2026-07-29