Back Linuxsecurity openSUSE vim Important Denial of Service and Execution Flaws 2026-3680
Find practical guidance for preventing, investigating, and responding to Linux security problems. Review Linux Privileges ×
This update for vim fixes the following issues:
* CVE-2026-73070: stack buffer overflow in the socket server can lead to
denial of service (bsc#1275018).
* CVE-2026-73071: use-after-free in JSON decoding can lead to process crash
* CVE-2026-73072: heap buffer overflow when loading a spell file can lead to
crash or potential code execution (bsc#1275016).
* CVE-2026-73074: heap buffer overflow in text property handling can lead to a
crash or potential code execution (bsc#1275015).
* CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a
conditional memory write (bsc#1275014).
* CVE-2026-73076: arbitrary command execution via the vimball record file
* CVE-2026-73077: arbitrary code execution due to insecure shell command
handling (bsc#1275012).
* CVE-2026-73078: arbitrary code execution via crafted netrw entries
* Updated to version 9.2.0957.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3680=1
* Basesystem Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-3680=1
* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-3680=1
* Desktop Applications Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-3680=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-3680=1
zypper in -t patch SUSE-2026-3680=1
* SUSE Linux Enterprise Micro 5.5
zypper in -t patch SUSE-SLE-Micro-5.5-2026-3680=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch...
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* vim-debugsource-9.2.0957-150500.20.64.1
* gvim-9.2.0957-150500.20.64.1
* vim-9.2.0957-150500.20.64.1
* vim-debuginfo-9.2.0957-150500.20.64.1
* vim-small-9.2.0957-150500.20.64.1
* vim-small-debuginfo-9.2.0957-150500.20.64.1
* gvim-debuginfo-9.2.0957-150500.20.64.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
* vim-data-9.2.0957-150500.20.64.1
* vim-data-common-9.2.0957-150500.20.64.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* vim-debugsource-9.2.0957-150500.20.64.1
* gvim-9.2.0957-150500.20.64.1
* vim-9.2.0957-150500.20.64.1
* vim-debuginfo-9.2.0957-150500.20.64.1
* vim-small-9.2.0957-150500.20.64.1
* vim-small-debuginfo-9.2.0957-150500.20.64.1
* gvim-debuginfo-9.2.0957-150500.20.64.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
* vim-data-9.2.0957-150500.20.64.1
* vim-data-common-9.2.0957-150500.20.64.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5...
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
Get the latest Linux and open source security news straight to your inbox.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
