CVE-2026-35177 vim CVE debrief

Who should care

Users of Vim versions prior to 9.2.0280 who handle zip archives within the editor are at risk. This includes developers, system administrators, and users who work with zip files in Vim. These users should verify their deployments and review the official advisory for affected scope and severity.

Technical summary

A path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives. The vulnerability is fixed in Vim version 9.2.0280. Users of affected versions should apply the patch or upgrade to prevent exploitation. This vulnerability has a CVSS score of 4.1 and is considered a significant risk for users of affected Vim versions. The vulnerability affects Vim versions prior to 9.2.0280.

Defensive priority

Apply the patch or upgrade to Vim version 9.2.0280 or later as soon as possible. Restrict access to zip archives. Monitor for suspicious activity.

Recommended defensive actions

• Apply the patch or upgrade to Vim version 9.2.0280 or later.
• Restrict access to zip archives.
• Monitor for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-04-06T18:16:44.003Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability affects Vim versions prior to 9.2.0280. Users should verify their deployments and review the official advisory for affected scope and severity. The CVE record provides details on the vulnerability, including its CVSS score and affected versions.

Official resources