CVE-2026-73073 vim CVE debrief

Who should care

Defenders responsible for systems or deployments using Vim, especially in environments with untrusted or user-supplied tags files, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-73073 is a high-severity vulnerability in Vim that allows arbitrary command execution. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Vim is used with untrusted or user-supplied tags files.

• Potential for arbitrary command execution
• Risk of exploitation through user-supplied tags files
• Need for version updates or mitigations
• Importance of restricting access to Vim in high-risk environments

Technical summary

The StructMembers() function in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file. This allows an attacker to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. The vulnerability exists in the StructMembers() function in runtime/autoload/ccomplete.vim, which constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Vim is used with untrusted or user-supplied tags files.

Recommended defensive actions

• Update Vim to version 9.2.0845 or later
• Use trusted sources for tags files
• Restrict access to Vim in environments with untrusted users
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• technicalSummary

Evidence notes

The vulnerability is fixed in Vim version 9.2.0845. Users should update to this version or apply mitigations to prevent exploitation. The StructMembers() function in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file. This allows an attacker to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. Evidence limits suggest a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.