CVE-2026-34714: Vim

High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Affected products

• Vim Vim: from 9.1.1390, before 9.2.0272 (fixed in 9.2.0272)

Published 2026-03-30. Last modified 2026-09-01.