CVE intelligence

CVE-2026-52859

Vulnerability intelligence

Published Jun 11, 2026Sources checked Nov 12, 2026

8.2HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-52859 and is rated High severity with a CVSS score of 8.2. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Jun 13, 2026

CBL-Mariner Releases

Vendor-listed releases

9.2.0620-1

CISA KEVNot listedBased on the latest collected catalog

EPSS0.3%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-52859?

Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken.

For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator.

When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters.

A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.

Source: NVD