Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFASTARTCOLL having a NULL out1 pointer. When nfamaxwidth() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
{
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32249.json",
"cwe_ids": [
"CWE-476"
]
}[
{
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "src/mbyte.c"
},
"source": "https://github.com/vim/vim/commit/ff2b79d23956263ab0120623c37e0b4498be01db",
"deprecated": false,
"digest": {
"line_hashes": [
"166136905862214116290371760684791573897",
"70131765348998850259356693173761465096",
"331524111427630990009183646515957450430",
"57552751488362765139281593066415981562",
"115317455662805452468509170638739071145",
"122912793687935429637363889752601342412",
"338647717832132709537044452353894205384",
"271197401975587326411105720713337563549",
"250836773048130165575683298874816084694",
"303568542950311201122813594463679687376",
"913302924331071668044757280096151216",
"117658322269568969249371153338808113986",
"92216507357153913532545320691028516858",
"6599383086453055698781456925553736582",
"243400711653338436414948582991044748692",
"242965920162778367918450476582879422725",
"212454783789398806679187971883498933180",
"219804401332523843275601178240270601409",
"240628193785779876683875777192603230273",
"228664992037369241927582889709871940575",
"76843103086669869759578016543494078995",
"56084585639939723145719022671170765094"
],
"threshold": 0.9
},
"id": "CVE-2026-32249-28b79d77"
},
{
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "src/version.c"
},
"source": "https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec",
"deprecated": false,
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"19960215250684593863169933232406122080",
"244739258361528853315491485194040993049",
"252869187014273337608946361672381339073"
],
"threshold": 0.9
},
"id": "CVE-2026-32249-361699a0"
},
{
"signature_version": "v1",
"signature_type": "Function",
"target": {
"function": "mb_off_next",
"file": "src/mbyte.c"
},
"source": "https://github.com/vim/vim/commit/ff2b79d23956263ab0120623c37e0b4498be01db",
"deprecated": false,
"digest": {
"function_hash": "303172537138372342407101020487357789911",
"length": 428.0
},
"id": "CVE-2026-32249-92651204"
},
{
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "src/version.c"
},
"source": "https://github.com/vim/vim/commit/ff2b79d23956263ab0120623c37e0b4498be01db",
"deprecated": false,
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"19960215250684593863169933232406122080",
"244739258361528853315491485194040993049",
"252869187014273337608946361672381339073"
],
"threshold": 0.9
},
"id": "CVE-2026-32249-ade0ea6f"
},
{
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "src/regexp_nfa.c"
},
"source": "https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec",
"deprecated": false,
"digest": {
"line_hashes": [
"9888209283700582819726698164959191600",
"203412388389960746598981401869502141699",
"95761606056985282684520606253407250755",
"11371368589280158702923678549439268515",
"238389132643529594135042985131294102885",
"155490675259042852324204764927727567362",
"88052243798467196263211761631284911646",
"249625568594272731409986056258596634901",
"337487349718831720787596543754981480412",
"127233056737802914924164891379951219342",
"239420414661615098083011561891794593954",
"130371612970693031616250900530139956485",
"193372627457863782791755952707333723913",
"209553550322486348702147037232589278397",
"23280553416786920179434657175595775873",
"10693611132336582814565426597365153952",
"99582656115611786795167179865026625007",
"286774880384631182114490286531195573139",
"254961404727033693564517579380264640659"
],
"threshold": 0.9
},
"id": "CVE-2026-32249-b1659ff2"
},
{
"signature_version": "v1",
"signature_type": "Function",
"target": {
"function": "nfa_max_width",
"file": "src/regexp_nfa.c"
},
"source": "https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec",
"deprecated": false,
"digest": {
"function_hash": "50942911982785332179650996627033703794",
"length": 3291.0
},
"id": "CVE-2026-32249-b69f15f3"
},
{
"signature_version": "v1",
"signature_type": "Function",
"target": {
"function": "nfa_regatom",
"file": "src/regexp_nfa.c"
},
"source": "https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec",
"deprecated": false,
"digest": {
"function_hash": "236598638612877112069822897136847941698",
"length": 12929.0
},
"id": "CVE-2026-32249-d16dffd7"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-32249.json"
"2026-04-16T12:09:12Z"