CVE-2026-73070

Executive Summary

CVE-2026-73070 is a stack-based buffer overflow (CWE-121) in the socket server backend of Vim, an open-source command-line text editor, affecting all versions prior to 9.2.0842. A local process capable of connecting to a running Vim server socket can open an unbounded number of client connections, overflowing the fixed-size fd_set structures in src/channel.c and struct pollfd arrays in src/os_unix.c, leading to stack memory corruption or termination of the Vim server. No public exploit code has been identified, the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and the EPSS score is low (0.00111); nevertheless, Vim instances running in server mode on multi-user or privileged hosts should be upgraded as soon as practical.

Technical Analysis

Vim supports a client–server model in which a Vim process acts as a server and accepts commands from other processes through a local socket. The vulnerable code path is centered on the function socketserver_accept() in src/socketserver.c. According to the NVD description, this function accepts client connections without enforcing any upper bound on the number of simultaneously connected clients.

Two downstream data structures are implicated:

• fd_set structures in src/channel.c: These are used by the select() mechanism to track file descriptors. An fd_set has a fixed capacity defined by FD_SETSIZE (typically 1024 on common Unix-like systems). When the number of open descriptors associated with accepted client connections reaches that capacity, the FD_SET macros write beyond the bounds of the fd_set buffer, causing a classic stack-based buffer overflow.
• Fixed-size struct pollfd arrays in src/os_unix.c: The poll() interface uses an array of struct pollfd entries. If the array is statically sized and the socket server accepts more connections than the array can hold, subsequent writes to those array slots corrupt adjacent stack memory.

The overflow is triggered purely by connection volume rather than by the content of any particular payload. Each accepted connection consumes a file descriptor; when the descriptor count exceeds the fixed array capacities, out-of-bounds writes occur. The consequence is stack memory corruption, which in the best case results in a crash of the Vim server process and in the worst case — depending on what adjacent stack data is overwritten and whether an attacker can influence it — may allow code execution in the context of the Vim process.

The attack surface is local. The attacker must be able to reach the server socket from the same host. Vim server sockets are typically created when Vim is started with its server feature enabled (e.g., --servername). Any local process running under the same or a more privileged account can connect to that socket. In multi-user environments, or when Vim is run with elevated privileges (for example, via sudo to edit system files), this flaw could be leveraged for local privilege escalation if memory corruption is successfully turned into code execution.

The vulnerability class is CWE-121 (Stack-based Buffer Overflow). The NVD description provides no CVSS vector or score, and the vendor has not published an independently confirmed advisory; the only patch claim originates from OSV, giving a patch confidence of 2/4 (CLAIMED — single source, not independently confirmed). The fixed version is 9.2.0842.

Exploitation Scenarios

No public proof-of-concept is available, and exploit code has not been observed in the wild. The attack chain below is therefore inferred from the vulnerability class and the mechanism described in the NVD record; specific implementation details beyond the cited source files and function should not be assumed.

1. Reconnaissance / target identification. An attacker with local access enumerates running Vim processes to identify instances acting as socket servers. This can be done with standard process listing utilities, looking for Vim processes started with server-mode flags. The attacker then locates the corresponding server socket in the local filesystem name space. No network scanning is required; the target is bound to the local host.

2. Triggering the flaw. The attacker opens many connections to the Vim server socket in a tight loop, deliberately exceeding the number of connections the server's descriptor-tracking structures can hold. Because socketserver_accept() imposes no bound on accepted client connections, the server continues to accept new connections, and the file descriptor count grows past the fixed capacity of the fd_set structures in src/channel.c and the struct pollfd arrays in src/os_unix.c.

3. Payload / execution method. At the vulnerability-class level, the overflow is driven by connection count, not by malicious data in any individual message. A denial-of-service outcome requires only the connection flood itself. For a memory-corruption-to-code-execution outcome, the attacker would need to influence the bytes written out of bounds — for example, by controlling descriptor values or adjacent stack contents — which is significantly more complex and is not demonstrated by any public PoC. Given the absence of public exploit code, the realistic near-term impact is a crash of the Vim server.

4. Post-exploitation impact. A crashed Vim server may lose unsaved buffers, disrupting any workflow or automation that depends on the server. If the Vim process runs with elevated privileges and the corruption is successfully refined into code execution, the attacker gains code execution in that privilege context, which constitutes local privilege escalation (MITRE ATT&CK T1068 — Exploitation for Privilege Escalation). In the absence of privilege elevation, the impact is a local denial-of-service against the Vim server and its dependent processes.

Impact Assessment

The affected product is Vim, an editor deployed across virtually all Unix-like operating systems and many embedded and enterprise environments. The vulnerable functionality is the socket server backend, which is only active when Vim is running in server mode; standard interactive editing sessions that do not create a server socket are not exposed to this flaw.

The blast radius is confined to a single host. The precondition of local access meaningfully reduces exposure: a remote, unauthenticated attacker cannot reach the vulnerable socket over the network. The highest-risk deployments are shared multi-user hosts, CI/CD and automation infrastructure where Vim is used as a headless server, and administrative workflows that run Vim with elevated privileges.

Because no CVSS vector or score was published, a quantitative severity rating is unavailable. Qualitative assessment: confidentiality and integrity impact are conditional on successful code execution (unproven publicly); availability impact is straightforward — an unprivileged local attacker can terminate the Vim server process at will. The low EPSS score (0.00111, 1.6th percentile) and absence from CISA KEV indicate that exploitation in the wild is not currently observed or expected in the near term.

Detection Guidance

Note: because the vulnerability is triggered over a local Unix domain socket (or similar local IPC mechanism), traditional network-based detection has limited visibility. The rules below focus on (a) identifying Vim server-mode processes — the precondition for exposure, and (b) crash artifacts and abnormal connection behavior that indicate exploitation attempts.

Sigma Rule

title: Vim Server Mode Process Creation
id: c0a9f7e2-6d1b-4b5a-9c3d-2f6a8e7b1c44
status: experimental
description: >
  Detects Vim processes started in server mode, which is the precondition
  for exposing the vulnerable socket server backend addressed by CVE-2026-73070.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73070
author: Valters IT Threat Intelligence
logsource:
  category: process_creation
  product: linux
detection:
  selection_linux:
    Image|endswith: '/vim'
    CommandLine|contains|all:
      - '--servername'
  selection_windows:
    Image|endswith: '\\vim.exe'
    CommandLine|contains|all:
      - '--servername'
  condition: selection_linux or selection_windows
falsepositives:
  - Legitimate use of Vim client-server functionality (e.g., remote editing workflows)
  - Automated tooling that intentionally starts Vim as a server
level: low
tags:
  - attack.t1068
  - cve.2026-73070

YARA Rule

rule vim_socket_server_cve_2026_73070
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detect binaries, scripts, or crash artifacts referencing Vim socket server internals associated with CVE-2026-73070"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73070"
        cve = "CVE-2026-73070"
        date = "2026-01-01"
    strings:
        $s1 = "socketserver_accept" ascii nocase
        $s2 = "socketserver.c" ascii nocase
        $s3 = "channel.c" ascii nocase
        $s4 = "os_unix.c" ascii nocase
        $s5 = "--servername" ascii nocase
        $s6 = "VIM - Vi IMproved" ascii nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        (2 of ($s1, $s2, $s3, $s4)) and
        $s6
}

Suricata IDS Rule

The vulnerable service is local IPC; the rule below addresses the network-analogous behavior (a connection flood against a service) in the event that Vim's server functionality is exposed over a TCP socket in a custom deployment.

alert tcp any any -> any any (msg:"CVE-2026-73070 Vim Socket Server Connection Flood Attempt"; flow:to_server; flags:S; threshold:type both, track by_src, count 200, seconds 5; classtype:attempted-dos; sid:20267307; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-73070;)

Elastic Detection

process where process.name in ("vim", "vim.exe")
  and process.args : "--servername*"

Additional EQL for crash-loop behavior indicative of a denial-of-service attempt:

sequence by host.name with maxspan=10m
  [ process where process.name in ("vim", "vim.exe") and process.args : "--servername*" ]
  [ file where event.action in ("deletion", "modification") and file.name : "core*" ]

Splunk SPL Query

Identify Vim server processes (exposed surface):

index="*" sourcetype="WinEventLog:Security" OR sourcetype="linux_audit"
| where (Image="*\\vim.exe" OR process="*vim") AND CommandLine="*--servername*"
| stats count earliest(_time) latest(_time) by host, user, CommandLine

Identify repeated Vim crashes (denial-of-service outcome):

index="*" (sourcetype="WinEventLog:Application" EventCode=1001 Message="*vim.exe*") OR (sourcetype="syslog" "*segfault*" "*vim*")
| bin _time span=5m
| stats count by host, _time
| where count > 3

Wazuh OSSEC Rule

<group name="vim,">
  <rule id="100730" level="10" frequency="3" timeframe="300">
    <if_sid>5715</if_sid>
    <field name="win.eventdata.image">.*\\vim\.exe</field>
    <description>CVE-2026-73070: Multiple Vim server process crashes detected — possible socket connection flood exploitation.</description>
    <group>vulnerability,cve-2026-73070,</group>
  </rule>

  <rule id="100731" level="6">
    <if_sid>5710</if_sid>
    <match>--servername</match>
    <description>CVE-2026-73070: Vim process started in server mode — verify whether server socket exposure is required.</description>
    <group>vulnerability,cve-2026-73070,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED). The fix is claimed by a single source (OSV) and has not been independently confirmed via a vendor advisory. Validate the fix in a staging environment before broad rollout.

1. Immediate mitigations:

   • If Vim client–server functionality is not required, do not start Vim with --servername; the vulnerable socket server backend will not be active.
   • On multi-user hosts, ensure the server socket is created with restrictive permissions so that only the owning user can connect.
   • Avoid running Vim in server mode under elevated privileges (root/Administrator) unless strictly necessary; this directly reduces the privilege-escalation risk.
   • Monitor for anomalous connection counts to Vim server sockets and for repeated Vim crashes.

2. Patch / upgrade steps:

   • Upgrade Vim to version 9.2.0842 or later, which contains the fix.
   • Verify the deployed version after upgrade (vim --version output).
   • Because the patch claim is not independently confirmed, retest client–server workflows after upgrading and monitor the vendor's release channels for an official advisory.

3. Long-term hardening:

   • Maintain a patching cadence for development and automation images that bundle Vim.
   • Enforce least privilege for local accounts; a local attacker capable of opening many sockets should not automatically gain elevated access.
   • Apply OS-level sandboxing (e.g., SELinux, AppArmor) to constrain Vim's socket creation and access.
   • Treat local socket services with the same rigor as network services in threat models: restrict access by user, monitor connection counts, and limit file descriptor usage where possible.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73070
• OSV Entry (patch source): https://osv.dev/vulnerability/CVE-2026-73070
• Vim Project: https://www.vim.org/
• Vim GitHub Repository (source files src/socketserver.c, src/channel.c, src/os_unix.c): https://github.com/vim/vim
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-73070 currently NOT listed; no known in-the-wild exploitation as of this writing)

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-73070 at the time of analysis.