ALAS2-2026-3883

References: CVE-2026-52859  CVE-2026-55892  CVE-2026-57455  CVE-2026-59857  CVE-2026-73073 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots -- a base character plus five combining marks -- the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565. (CVE-2026-52859)

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662. (CVE-2026-55892)

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698. (CVE-2026-57455)

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725. (CVE-2026-59857)

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845. (CVE-2026-73073)

Issue Correction:
Run yum update vim or yum update --advisory ALAS2-2026-3883 to update your system.

New Packages:

aarch64:
    vim-common-9.0.2153-1.amzn2.0.11.aarch64
    vim-minimal-9.0.2153-1.amzn2.0.11.aarch64
    vim-enhanced-9.0.2153-1.amzn2.0.11.aarch64
    vim-X11-9.0.2153-1.amzn2.0.11.aarch64
    xxd-9.0.2153-1.amzn2.0.11.aarch64
    vim-debuginfo-9.0.2153-1.amzn2.0.11.aarch64

i686:
    vim-common-9.0.2153-1.amzn2.0.11.i686
    vim-minimal-9.0.2153-1.amzn2.0.11.i686
    vim-enhanced-9.0.2153-1.amzn2.0.11.i686
    vim-X11-9.0.2153-1.amzn2.0.11.i686
    xxd-9.0.2153-1.amzn2.0.11.i686
    vim-debuginfo-9.0.2153-1.amzn2.0.11.i686

noarch:
    vim-filesystem-9.0.2153-1.amzn2.0.11.noarch
    vim-data-9.0.2153-1.amzn2.0.11.noarch

src:
    vim-9.0.2153-1.amzn2.0.11.src

x86_64:
    vim-common-9.0.2153-1.amzn2.0.11.x86_64
    vim-minimal-9.0.2153-1.amzn2.0.11.x86_64
    vim-enhanced-9.0.2153-1.amzn2.0.11.x86_64
    vim-X11-9.0.2153-1.amzn2.0.11.x86_64
    xxd-9.0.2153-1.amzn2.0.11.x86_64
    vim-debuginfo-9.0.2153-1.amzn2.0.11.x86_64