CVE-2026-73071

Executive Summary

CVE-2026-73071 is a use-after-free (CWE-416) vulnerability in the JSON decoder of the Vim text editor, affecting the json_decode_item() function in src/json.c. Vim versions from 9.2.0511 up to but not including 9.2.0844 are affected; the issue is fixed in version 9.2.0844. An attacker who can cause Vim to parse a specially crafted JSON document — for example, a malicious file opened by a local user, or JSON delivered over Vim's channel input — can trigger a read from freed memory in the parser's error path, leading to abnormal termination of the editor and a low-availability denial of service.

Technical Analysis

The vulnerability resides in Vim's built-in JSON parsing routines. The root cause is a stale-pointer condition in json_decode_item(), one of the core functions responsible for walking the JSON token stream. During the decoding of a string literal, json_decode_string() is invoked to consume the string tokens. If the string data is invalid and spans the boundary of the current input buffer, the code path invokes channel_fill() to refill the parser's buffer. According to the NVD description, channel_fill() frees the current buffer as part of the refill operation. However, json_decode_item() can retain a pointer into the old, now-freed buffer. When the parser subsequently enters its error path, it dereferences this stale pointer instead of correctly recomputing the position from reader->js_buf + reader->js_used, producing a read of freed memory.

This is a textbook use-after-free: the lifetime of the buffer object ends while a local reference to it is still held in an enclosing stack frame. The fact that the stale dereference occurs on the error path is significant — it means the vulnerable condition is triggered by malformed input that causes the decoder to bail out, rather than by valid JSON that completes successfully. From an attacker's perspective, the input only needs to be recognized as an invalid JSON string by the parser; the malformed string must also be long enough (or positioned such) that it crosses the parser's internal buffer boundary, forcing the channel_fill() refill before the error is reported.

The attack surface is any context in which Vim decodes JSON content: opening a .json file directly in the editor, invoking the JSON decoder from Vimscript or plugin code, or receiving JSON via Vim's channel/job input facility (the function name channel_fill() indicates that the buffer management is tied to channel-based input). Because the vulnerability class is a memory-corruption bug in a parser, it is reachable in every Vim build compiled with the JSON feature for the affected version range.

The severity is constrained by the CVSS vector. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L indicates a local attack vector requiring low privileges, no user interaction, no scope change, and zero confidentiality or integrity impact, with only a low availability impact. In practical terms, the most likely observable consequence is a crash of the Vim process (e.g., SIGSEGV) when the error path dereferences the freed buffer. The NVD description does not indicate that this primitive is exploitable for code execution or memory disclosure; without a working proof of concept, such outcomes remain speculative.

Exploitation Scenarios

No public PoC or exploit code is known for CVE-2026-73071 at the time of writing, and the CVE is not listed in CISA KEV. The attack chain below is therefore inferred from the vulnerability class and the NVD description rather than from observed exploit activity.

1. Reconnaissance / target identification: The attacker identifies a system where Vim 9.2.0511 through 9.2.0843 is used. Because the attack vector is local (AV:L) with a low-privilege requirement (PR:L), the most realistic delivery model is either (a) a low-privilege local user on a shared multi-user system who can induce another user (or an automated job) to open a malicious file in Vim, or (b) social engineering / malformed document delivery where the victim opens an untrusted .json file. The attacker does not need network access to the target.

2. Triggering the flaw: The attacker crafts a JSON document containing an invalid string literal that is deliberately sized and positioned so that the string token spans the parser's current buffer boundary. When Vim parses the document, json_decode_string() processes the string and, upon reaching the buffer boundary, invokes channel_fill() to refill the input buffer — an operation that frees the previous buffer. The parsing then fails validation of the malformed string, and the error path in json_decode_item() dereferences the stale pointer retained from before the refill, reading freed memory.

3. Payload / execution method: At the vulnerability-class level, the "payload" is entirely data — the malformed JSON file itself. No code injection is required and no scripting construct is used; the trigger is purely the parser's state transition on malformed input. The attacker delivers the file through whatever channel the victim uses to acquire or open JSON documents (email attachment, downloaded configuration file, or existing file on a shared filesystem).

4. Post-exploitation impact: The dereference of freed memory in the error path results in undefined behavior, most likely an immediate crash of the Vim process. Given the CVSS vector — C:N/I:N/A:L — the expected impact is a denial-of-service condition affecting the editing session and potentially unsaved work in the editor. There is no evidence that this flaw grants privilege escalation, data exfiltration, or remote code execution. On a heavily used administration or development workstation, repeated crashes could represent a minor availability nuisance but not a system-wide compromise.

Impact Assessment

Business impact: The business impact of CVE-2026-73071 is low. The vulnerability produces a local, low-severity availability impact with no confidentiality or integrity consequences. An affected organization would most likely observe sporadic crashes of developer or administrator Vim sessions when processing malformed or maliciously crafted JSON documents. Because the vulnerable code path requires a specific malformed input crossing a buffer boundary, accidental triggering is unlikely; deliberate triggering requires local access or successful file-delivery social engineering.

Affected systems: All Vim builds in the version range 9.2.0511 through 9.2.0843 that include the JSON decoding feature are affected. This includes Vim installed on developer workstations, CI runner images, containers, and any server-side automation that invokes Vim or Vimscript to process JSON content. Package-managed and self-compiled distributions are equally affected.

Blast radius: The blast radius is confined to the local Vim process. The CVSS sub-scores are: Attack Vector Local (AV:L), Attack Complexity Low (AC:L), Privileges Required Low (PR:L), User Interaction None (UI:N), Scope Unchanged (S:U), Confidentiality None (C:N), Integrity None (I:N), and Availability Low (A:L). The scope-unchanged and local-vector characteristics mean that no adjacent network segment, remote service, or adjacent process is placed at risk. EPSS estimates the probability of exploitation in the wild at 0.00109 (1.4% percentile of scored CVEs), which is very low, and the CVE is absent from the CISA Known Exploited Vulnerabilities catalog. No threat-actor campaigns referencing this CVE have been identified.

Detection Guidance

Detection of CVE-2026-73071 is inherently difficult because the trigger is a malformed JSON file that only crashes the local Vim process; there is no network service banner, no malware beacon, and no established C2 pattern to match. The following detection content therefore focuses on (a) abnormal termination of Vim, (b) crash artifacts referencing the vulnerable decoder symbols, and (c) heuristic identification of JSON files with characteristics consistent with a buffer-boundary-crossing attack payload. Baselines should be tuned per environment, as unrelated Vim crashes and legitimate large JSON files will produce false positives.

Sigma Rule

The following Sigma rule detects Linux syslog/kernel messages reporting a Vim process crash, which is the most likely observable artifact of the use-after-free at this severity level.

title: Vim Abnormal Termination - Potential JSON Decoder UAF (CVE-2026-73071)
id: 7f6b3c5d-3a2e-4f8b-9c1d-2e4f6a8b0c1d
status: experimental
description: Detects abnormal termination of the Vim editor process (e.g., SIGSEGV) possibly associated with the JSON decoder use-after-free in src/json.c described by CVE-2026-73071.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73071
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
    product: linux
    service: syslog
detection:
    selection:
        message|contains|all:
            - 'vim'
            - 'segfault'
    condition: selection
falsepositives:
    - Legitimate crashes caused by unrelated bugs or memory pressure
level: medium

For Windows-based Vim (gvim/vim.exe), a corresponding rule should monitor Application Event Log Event ID 1001 (Windows Error Reporting) for faulting application names containing vim or gvim, with ExceptionCode indicating an access violation.

YARA Rule

The following YARA rule flags JSON documents containing a high density of very long string literals, a heuristic consistent with an input crafted to force the parser to refill its buffer mid-string, as required to reach the stale-pointer path.

/*
   CVE-2026-73071 — Heuristic detection of JSON inputs crafted to cross the
   Vim JSON parser's internal buffer boundary and trigger the stale-pointer
   read in json_decode_item().
*/
rule CVE_2026_73071_Vim_JSON_UAF_Crafted_Input
{
    meta:
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        description = "Flags JSON documents containing multiple very long string literals, consistent with a crafted input for CVE-2026-73071."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73071"
        cve = "CVE-2026-73071"
    strings:
        $long_string = /"[^"\\]*(?:\\.[^"\\]*){1024,}"/
    condition:
        filesize < 20MB and #long_string >= 3
}

A second YARA rule detects Vim crash artifacts (core dumps, crash-report text) that reference the vulnerable decoder code, providing forensic value when investigating reported crashes.

rule CVE_2026_73071_Vim_Crash_Artifact
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Core dump or crash trace referencing the vulnerable JSON decoder symbols."
        cve = "CVE-2026-73071"
    strings:
        $sym1 = "json_decode_item" ascii
        $sym2 = "json_decode_string" ascii
        $sym3 = "channel_fill" ascii
        $sym4 = "src/json.c" ascii
        $sym5 = "reader->js_buf" ascii
    condition:
        2 of ($sym*) and filesize < 512MB
}

Suricata IDS Rule

The vulnerability is local, but malicious JSON frequently traverses the network inside HTTP responses, downloads, or API payloads. The following Suricata rules flag HTTP traffic carrying oversized JSON string literals matching the heuristic profile of the trigger input. These are behavioral rules; they detect the payload archetype rather than a unique exploit signature.

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-73071 - Potential Vim JSON decoder UAF trigger, oversized JSON string in HTTP response"; flow:to_client,established; file_data; pcre:/"[^"\\]*(?:\\.[^"\\]*){2048,}"/; classtype:attempted-dos; reference:cve,2026-73071; sid:202673071; rev:1;)

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-73071 - Large JSON request body potentially crafted for Vim JSON parser"; flow:to_server,established; http.content_type; content:"application/json"; http.request_body; length:100000; classtype:attempted-dos; reference:cve,2026-73071; sid:202673072; rev:1;)

Operators should expect false positives from legitimate large JSON API exchanges and should tune thresholds to local traffic baselines.

Elastic Detection

The following EQL rule detects Vim processes terminating abnormally, where the exit code indicates a segmentation fault (-11 on Linux). This is the most direct process-level signal of the use-after-free manifesting as a crash.

process where event.category == "process" and event.type in ("end", "info")
  and process.name in ("vim", "vim.basic", "vim.tiny", "vim.exe")
  and process.exit_code == -11

A complementary file-event rule flags unusually large JSON files opened by Vim, which may represent the crafted payload:

file where event.category == "file" and file.name : "*.json" and file.size > 1000000
  and (process.name : "vim*" or process.name : "vim.exe")

The file-based rule is deliberately broad; analysts should correlate hits with subsequent Vim crash events.

Splunk SPL Query

The primary Splunk query searches syslog-style sources for Vim crash indicators and enriches them with first-seen/last-seen and host aggregation:

(index=unix OR index=os) sourcetype="syslog" ("vim" AND ("segfault" OR "general protection fault" OR "SIGSEGV"))
| eval severity=case(searchmatch("segfault"),"high", searchmatch("SIGSEGV"),"high", true(),"medium")
| stats min(_time) as first_seen max(_time) as last_seen count by host, source, severity
| convert ctime(first_seen) ctime(last_seen)

For Windows endpoints running gvim/vim.exe, query the Application event log for Windows Error Reporting entries:

index=windows EventCode=1001 (Application="*vim*" OR Application="*gvim*")
| table _time, host, Application, ApplicationName, FaultingModule, ExceptionCode

Wazuh OSSEC Rule

The following Wazuh rule fires when the syslog source records a Vim process crash, correlating the process name with a segmentation-fault indicator. It is designed to be deployed in a custom rule file (e.g., local_rules.xml).

<group name="vim,">
    <rule id="100301" level="7">
        <if_sid>550</if_sid>
        <match>vim</match>
        <regex>segfault|general protection fault|SIGSEGV</regex>
        <description>Vim process terminated abnormally - potential CVE-2026-73071 JSON decoder use-after-free</description>
        <group>vim,</group>
    </rule>
</group>

Adjust the level value according to organizational criticality; level 7 is appropriate for a probable security-relevant process crash without confirmed lateral movement or data impact.

Mitigation & Patch Guidance

Patch confidence for this CVE is rated 2/4 (CLAIMED) — a single source (OSV) reports the fix, and it has not been independently confirmed. Organizations should verify the patch by upgrading to a known-good release and confirming the version string, rather than relying solely on advisory text.

1. Immediate mitigations: If Vim 9.2.0844 or later cannot be deployed immediately, restrict the processing of untrusted JSON content in Vim. Do not open JSON files from untrusted sources, email attachments, or downloaded repositories in the affected Vim versions. For automated JSON processing, use a dedicated parser (e.g., jq, Python's json module) instead of Vim/Vimscript until the upgrade is applied. Disable or audit plugins that automatically parse JSON buffers, and avoid exposing Vim's channel/job input to untrusted data sources. Because the attack vector requires local access, also restrict local shell access to trusted users on shared systems.

2. Patch / upgrade steps: Upgrade Vim to version 9.2.0844 or later. On Debian/Ubuntu systems, use sudo apt update && sudo apt install vim. On Red Hat/Fedora, use sudo dnf update vim (or sudo yum update vim). On other platforms, obtain the updated package from the official Vim distribution and verify the installed version with vim --version (the version line must report 9.2.0844 or higher). If the distribution package has not yet picked up the fixed release, compile from the upstream source at the fixed tag. After patching, confirm the OSV-referenced commit 1d727b6f74896915a94f7d0e134d64cb0eac8045 or a descendant is present in the build provenance if source-level verification is required.

3. Long-term hardening: Subscribe to Vim security announcements and monitor OSV/NVD for updates to this CVE, particularly any change in patch confidence, PoC availability, or KEV status. Build Vim with modern memory-safety hardening options where feasible (ASLR, stack protection, and relocatable code), although note that compiler hardening does not eliminate use-after-free reads in the vulnerable code path — only the patch does. Establish crash telemetry (core dumps, WER, syslog) as part of standard endpoint monitoring so that future parser vulnerabilities produce detectable artifacts. Periodically review local file-watching rules for unexpected large JSON files appearing on developer and admin workstations, and treat unexplained Vim crashes as potentially security-relevant events pending a root-cause review.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73071
• MITRE CVE record: https://www.cve.org/CVERecord?id=CVE-2026-73071
• OSV vulnerability advisory: https://osv.dev/vulnerability/CVE-2026-73071
• Vim project official site (version/release information): https://www.vim.org

No known threat-actor campaigns or exploit-in-the-wild evidence exist for CVE-2026-73071 as of this report. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public PoC or Nuclei/exploit template has been identified. EPSS places the exploitation probability at 0.00109 (1.4% percentile), indicating that active exploitation is currently unlikely; this assessment should be revisited as new information becomes available.