CVE-2026-73076

Executive Summary

CVE-2026-73076 is a code-injection vulnerability (CWE-94) in the vimball plugin component of Vim, an open-source command-line text editor. Affecting all versions prior to 9.2.0847, the flaw resides in runtime/autoload/vimball.vim and allows a specially crafted vimball archive member named .VimballRecord to overwrite Vim's installation record with attacker-controlled Ex commands. When the vimball#RmVimball() function later processes the matching record entry, the stored commands — including operating-system commands invoked through the :! prefix — execute with the full privileges of the user running Vim. Exploitation requires user interaction (installing or processing a malicious vimball archive), and no CVSS vector, public PoC, or CISA KEV listing is available at the time of writing.

Technical Analysis

Vimball is a plugin-packaging format used to bundle Vim scripts, documentation, and support files into a single distributable archive. The vulnerable implementation resides in runtime/autoload/vimball.vim, which handles archive extraction, installation-record maintenance, and plugin removal for the vimball format.

The vulnerability mechanism, as described in the NVD record, is an insufficient-input-validation issue leading to arbitrary code injection. The vimball installation record is stored as a file named .VimballRecord. Under normal operation, this record tracks which files belong to which installed vimball plugin so that vimball#RmVimball() can later remove them cleanly. The flaw is that a crafted vimball archive can include a member that is itself named .VimballRecord. When such an archive is processed, the attacker-supplied member overwrites the legitimate installation record with content chosen by the attacker — specifically, attacker-controlled Ex command lines.

Ex commands are Vim's built-in scripting/command language. Because Vim's command language allows delegation to the operating system through the :! command prefix, arbitrary OS command strings can be embedded in the forged .VimballRecord entry. The NVD description explicitly states that when vimball#RmVimball() later processes the matching record entry, the stored Ex commands — including OS commands invoked via :! — are executed with the privileges of the user running Vim. This transforms a data-file-overwrite primitive into direct, arbitrary command execution during a subsequent, seemingly benign Vim operation (e.g., uninstalling a plugin via the vimball cleanup routine).

The attack surface is any Vim user who installs or processes a vimball archive from a third-party source. Public plugin repositories, shared dotfiles repositories, email attachments, and download links in documentation are all plausible distribution vectors. The vulnerability is local in reach but can be triggered purely by opening and installing a malicious archive; no special Vim privileges or elevated OS access are required.

Specific technical details beyond the NVD description — such as the exact parsing loop, the record-format grammar, and the precise code path that writes the .VimballRecord file — are not disclosed in the provided data. Insufficient technical detail is available to reconstruct the vulnerable code path line-by-line. The patch is claimed only by a single source (OSV) for version 9.2.0847 and has a 2/4 confidence rating, meaning it has not been independently confirmed against the upstream Vim repository at the time of writing.

Exploitation Scenarios

Attack chain for CVE-2026-73076, inferred strictly from the NVD description and vulnerability class:

1. Reconnaissance / target identification. The attacker identifies Vim users who employ vimball-based plugin installation — a common workflow for developers, system administrators, and enterprise DevOps engineers. Targets are reached through social engineering: poisoned plugin download links, typosquatted plugin names, malicious entries in community plugin lists, or backdoored dotfiles/dotfile managers that include vimball archives. The attacker does not require network access to the victim's Vim instance; delivery of the malicious archive is the primary objective.

2. Trigger of the vulnerable class. The victim processes a crafted vimball archive containing a member named .VimballRecord. Because the archive is processed by runtime/autoload/vimball.vim, the installation-record overwrite path is exercised. The flaw class is code injection via untrusted input that is not distinguished from trusted internal metadata — the attacker's .VimballRecord member is treated as legitimate installation bookkeeping rather than as attacker-controlled content. The trigger itself is a standard user action (installing the archive), so no exotic command sequences or privileged access are necessary on the victim's side.

3. Payload / execution method. The attacker populates the forged .VimballRecord member with Ex command lines. At the vulnerability-class level, the payload is a command script injected into a data file that is later interpreted as executable code. The description specifically notes that the stored Ex commands may include operating-system commands invoked through the :! prefix, e.g., :!command style delegation to the host shell. The actual execution occurs when vimball#RmVimball() later processes the matching record entry — this is a deferred-trigger design, meaning the payload may detonate on an unrelated later action, such as removing or cleaning up a plugin, rather than at initial install time. No public PoC is available; the execution chain is inferred from the vulnerability class and the explicitly named functions.

4. Post-exploitation impact. With arbitrary OS command execution under the identity of the Vim user, the attacker can read and exfiltrate files (credentials, SSH keys, source code), install persistence mechanisms (malicious plugins, modified .vimrc, shell startup hooks), and pivot to other systems if the compromised account holds additional privileges. In enterprise environments, a compromised developer workstation can become a beachhead for lateral movement toward CI/CD systems, version-control servers, and production infrastructure. The deferred execution model also complicates attribution: the malicious archive and the command execution may be separated in time, and even in user intent, if the victim installs one plugin and later invokes cleanup on a different, benign vimball.

Impact Assessment

Business impact. Successful exploitation yields arbitrary operating-system command execution as the user running Vim. This directly violates the confidentiality of any data readable by that user, the integrity of files writable by that user (including editor configuration, scripts, and project source code), and the availability of the user's session and potentially adjacent systems. Because command execution inherits the full user context, the impact is equivalent to the user typing the attacker's commands themselves — there is no privilege boundary to cross first. The functional impact is rated High on confidentiality, integrity, and availability in conventional CVSS scoring terms, although no CVSS vector has been published for this CVE (N/A).

Affected systems. All Vim installations prior to 9.2.0847 that ship or enable the vimball runtime components are potentially vulnerable. This includes Linux, Windows, macOS, and Unix-like platforms on which Vim is installed, since the vulnerable code is platform-independent script logic. Organizations that distribute a standard Vim configuration to many developer workstations, or that allow users to self-install plugins from the internet, have the largest exposed population.

Blast radius. The execution blast radius is the user account running Vim. On a typical developer workstation this includes source repositories, shell history, SSH agent sockets, cloud CLI credentials, and the ability to spawn interactive shells. Lateral movement potential depends on the privileges and network reachability of the compromised account. The exploit is not remotely triggerable without user interaction, which limits its worm-like potential. EPSS places the probability of exploitation in the wild at 0.00131 (3.1st percentile of CVEs), and there is no CISA KEV listing and no confirmed in-the-wild exploitation as of the report date. The primary near-term risk is targeted supply-chain-style attacks on developer communities rather than broad automated exploitation.

Detection Guidance

The detection rules below target the two observable phases of this attack: (a) the creation or modification of a .VimballRecord file in a user's Vim runtime directory, and (b) suspicious process executions whose parent is the Vim process (indicating :!-based OS command delegation from Vim). Because the exploit executes locally, network-based detection has limited value; host-based telemetry should be considered authoritative.

Sigma Rule

title: Vim vimball .VimballRecord Overwrite and Command Delegation (CVE-2026-73076)
id: 5f1d7a4c-7307-4b2e-9f3d-8a2c1b6e7d90
status: experimental
description: Detects creation of a .VimballRecord file followed by execution of child processes from Vim, indicating potential exploitation of CVE-2026-73076 via crafted vimball archives.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73076
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
    category: file_event
    product: linux
detection:
    selection_record_creation:
        TargetFilename|endswith: '/.VimballRecord'
        EventType: CreateFile
    condition: selection_record_creation
    timeframe: 30s
level: high
falsepositives:
    - Legitimate vimball plugin installation updating the .VimballRecord file
    - Automated dotfiles bootstrapping scripts that manage Vim plugins
---
title: Suspicious Child Process from Vim Process (CVE-2026-73076)
id: 5f1d7a4c-7307-4b2e-9f3d-8a2c1b6e7d91
status: experimental
description: Detects Vim spawning a shell or executing OS commands, which may indicate stored Ex commands with :! delegation executing via vimball#RmVimball().
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith: '/vim'
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/zsh'
            - '/cmd.exe'
            - '/powershell.exe'
    condition: selection
level: high
falsepositives:
    - Users intentionally running shell commands from within Vim with :!
    - Vim plugins that legitimately invoke external tools (e.g., linters, compilers)

YARA Rule

rule CVE_2026_73076_VimballRecord_Overwrite
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects vimball archive files (.vba) that embed a .VimballRecord member with Ex command content, indicating attempted exploitation of CVE-2026-73076."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73076"
        date = "2026-01-01"
        cve = "CVE-2026-73076"
        severity = "high"
    strings:
        $record_marker = ".VimballRecord"
        $cleanup_func = "vimball#RmVimball()"
        $ex_delegate = ":!"
        $vimball_header = "Vimball"
        $record_start = "[[1,"
        $ex_command = /:[a-zA-Z]+!/
    condition:
        uint16(0) == 0x8B1F and          // gzip magic (vimball archives are compressed)
        $record_marker and $vimball_header and
        1 of ($ex_delegate, $ex_command) and
        // At least one of the functions invoked during record processing is referenced
        #cleanup_func >= 1
}

Suricata IDS Rule

# Network detection note: CVE-2026-73076 detonates on local file processing.
# This rule flags downloads of vimball archives that advertise a .VimballRecord
# member and embedded Ex-command/shell content, which is the malicious payload pattern.
alert http any any -> any any (msg:"CVE-2026-73076 - Suspicious Vimball Archive with .VimballRecord and Shell Delegation Content"; flow:established,to_client; file.data; content:"Vimball"; nocase; content:".VimballRecord"; nocase; distance:0; within:4096; content:":!"; nocase; distance:0; within:4096; classtype:attempted-user; sid:7307601; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-73076;)

alert http any any -> any any (msg:"CVE-2026-73076 - Vimball Archive Download (Potential Plugin Supply-Chain Vector)"; flow:established,to_client; http.uri; content:".vba"; endswith; nocase; http.uri; content:".vmb"; endswith; nocase; classtype:unknown; sid:7307602; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-73076;)

Elastic Detection

// EQL detection for the local file-system phase of CVE-2026-73076
file where event.module == "endpoint" and event.action in ("creation", "modification") and file.name == ".VimballRecord"

// EQL detection for the execution phase: Vim spawning a shell child,
// consistent with :! delegation of stored Ex commands in vimball#RmVimball()
process where event.module == "endpoint" and event.action == "exec"
    and process.parent.name in ("vim", "vim9", "gvim")
    and process.name in ("sh", "bash", "dash", "zsh", "ksh", "cmd.exe", "powershell.exe", "pwsh")

// EQL detection for Vim invoked with suspicious archive/source arguments
process where event.module == "endpoint" and event.action == "exec"
    and process.name in ("vim", "gvim")
    and (process.command_line : "*:source*" or process.command_line : "*.vba*")

Splunk SPL Query

# Phase 1: .VimballRecord file creation/modification events (Linux auditd / Sysmon)
index=main sourcetype=linux:audit OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational
( file.name=".VimballRecord" OR object_file_name=".VimballRecord" OR image="*\\vim.exe" )
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, file.path

# Phase 2: Vim spawning OS shells (execution phase of CVE-2026-73076)
index=main sourcetype=ProcessRollup2 OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational
( parent_process_name IN ("vim.exe","vim","gvim.exe") )
AND ( process_name IN ("sh","bash","dash","zsh","cmd.exe","powershell.exe","pwsh") )
| table _time host user parent_process_name process_name process_path cmdline
| sort - _time

# Phase 3: Correlate — find hosts where both events co-occur within a short window
index=main sourcetype=ProcessRollup2
| where parent_process_name IN ("vim","vim.exe","gvim.exe") OR process_name IN ("sh","bash","cmd.exe","powershell.exe")
| eventstats values(process_name) as procs by host
| search procs IN ("sh","bash","cmd.exe","powershell.exe")
| eval threat_score = if(match(procs,"(sh|bash|cmd\\.exe|powershell\\.exe)"), 90, 0)
| where threat_score > 0
| table _time host user parent_process_name process_name cmdline

Wazuh OSSEC Rule

<!-- Wazuh rule: Detect .VimballRecord file creation/modification (associated with CVE-2026-73076) -->
<rule id="100730" level="12">
  <if_sid>550</if_sid>
  <field name="file">\.VimballRecord$</field>
  <description>CVE-2026-73076: .VimballRecord file created or modified — possible vimball installation-record overwrite attempt.</description>
  <group>ossec, syscheck, vim, cve2026</group>
  <options>no_full_log</options>
</rule>

<!-- Wazuh rule: Vim process spawning a system shell (execution via :! delegation) -->
<rule id="100731" level="10">
  <if_sid>510</if_sid>
  <field name="audit.data.msg">type=EXECVE</field>
  <field name="audit.data.argc">3</field>
  <field name="audit.data.a0">sh</field>
  <group>auditd, vim, cve2026, suspension</group>
  <description>CVE-2026-73076: OS command executed from a Vim context — verify whether it originates from vimball#RmVimball() clean-up or user-initiated :!.</description>
</rule>

<!-- Active response recommendation: alert only; escalate for blocking only after false-positive triage -->
<rule id="100732" level="1">
  <if_sid>100731</if_sid>
  <description>CVE-2026-73076 suppression rule for trusted Vim :! usage (tailor per environment).</description>
  <group>vim, cve2026</group>
</rule>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). The only patch source in the provided data is OSV, which states the issue is fixed in version 9.2.0847. This has not been independently verified against the upstream Vim repository release notes at the time of writing. Administrators should treat the patch as likely-but-unconfirmed and validate the installed version's behavior after upgrading.

1) Immediate mitigations:

• Do not install or process vimball archives (.vba, .vmb, or gzipped archive files) obtained from untrusted or unvetted sources. Treat vimball archives as executable code, equivalent to a shell script or binary.
• If the vimball plugin is not required for organizational workflows, remove or disable the runtime/autoload/vimball.vim component from Vim's runtime path.
• Run Vim with the least privilege practical; use a dedicated, restricted OS account or sandboxing (firejail, bubblewrap, SELinux/AppArmor confinement) for sessions that process untrusted archives.
• Before installing any vimball archive, inspect it in a controlled environment (uncompressed, plain-text review) specifically checking for members named .VimballRecord and for Ex command lines containing :!.
• Monitor developer workstations for the .VimballRecord file-creation and Vim-to-shell process-spawn patterns defined in the Detection Guidance section above.

2) Patch / upgrade steps:

• Upgrade Vim to version 9.2.0847 or later from the official Vim project release channel — do not download patched builds from third-party mirrors.
• After upgrading, verify the version with vim --version and confirm the target version is >= 9.2.0847.
• Because patch confirmation is at 2/4 confidence, independently verify by checking the upstream Vim GitHub repository (tag/commit v9.2.0847 area) or the official Vim release announcement for any note referencing vimball.vim or the .VimballRecord handling.
• Re-run the validation after any OS package-manager update that might regress the Vim package to an older snapshot.

3) Long-term hardening:

• Establish an enterprise allowed-plugin list; require code review of any Vim plugin before distribution to the fleet.
• Centralize Vim configuration management (e.g., managed dotfiles with signed/checksummed archives) to remove the need for users to download plugins directly.
• Enforce endpoint monitoring on developer workstations for editor-to-shell process transitions — this behavior is high-signal for a range of plugin and editor vulnerabilities beyond CVE-2026-73076.
• Periodically audit installed plugins and the .VimballRecord file for unexpected entries; treat any unrecognized record entries as a potential compromise indicator.
• Maintain awareness of the CVE for at least 90 days post-patch, as exploitation in the wild is currently unconfirmed but the vulnerability class (editor-installed-backdoor) is attractive to supply-chain attackers targeting developer communities.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-73076
2. OSV Vulnerability Record — https://osv.dev/vulnerability/CVE-2026-73076 (patch source: fixed in 9.2.0847; single-source claim)
3. Vim Official Project — https://www.vim.org/ (release channel for version 9.2.0847 and later)
4. Vim Source Repository — https://github.com/vim/vim (independent patch verification recommended given 2/4 patch confidence)
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-73076: not listed as of report date)

In-the-wild evidence: None confirmed. There are no known threat-actor campaigns, no public exploit code, no Nuclei template, and no CISA KEV entry associated with CVE-2026-73076 at the time of writing. EPSS estimates a 0.00131 probability of exploitation (3.1st percentile of all CVEs), indicating very low near-term exploitation likelihood; the primary risk is targeted, interaction-dependent supply-chain attacks against Vim users.