Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFASTARTCOLL having a NULL out1 pointer. When nfamaxwidth() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
{
"cwe_ids": [
"CWE-476"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32249.json"
}[
{
"signature_version": "v1",
"target": {
"file": "src/version.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"146200493773228420153804765641940418619",
"19960215250684593863169933232406122080",
"244739258361528853315491485194040993049",
"252869187014273337608946361672381339073"
]
},
"source": "https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec",
"signature_type": "Line",
"id": "CVE-2026-32249-361699a0",
"deprecated": false
},
{
"signature_version": "v1",
"target": {
"file": "src/regexp_nfa.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"9888209283700582819726698164959191600",
"203412388389960746598981401869502141699",
"95761606056985282684520606253407250755",
"11371368589280158702923678549439268515",
"238389132643529594135042985131294102885",
"155490675259042852324204764927727567362",
"88052243798467196263211761631284911646",
"249625568594272731409986056258596634901",
"337487349718831720787596543754981480412",
"127233056737802914924164891379951219342",
"239420414661615098083011561891794593954",
"130371612970693031616250900530139956485",
"193372627457863782791755952707333723913",
"209553550322486348702147037232589278397",
"23280553416786920179434657175595775873",
"10693611132336582814565426597365153952",
"99582656115611786795167179865026625007",
"286774880384631182114490286531195573139",
"254961404727033693564517579380264640659"
]
},
"source": "https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec",
"signature_type": "Line",
"id": "CVE-2026-32249-b1659ff2",
"deprecated": false
},
{
"signature_version": "v1",
"target": {
"function": "nfa_max_width",
"file": "src/regexp_nfa.c"
},
"digest": {
"length": 3291.0,
"function_hash": "50942911982785332179650996627033703794"
},
"source": "https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec",
"signature_type": "Function",
"id": "CVE-2026-32249-b69f15f3",
"deprecated": false
},
{
"signature_version": "v1",
"target": {
"function": "nfa_regatom",
"file": "src/regexp_nfa.c"
},
"digest": {
"length": 12929.0,
"function_hash": "236598638612877112069822897136847941698"
},
"source": "https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec",
"signature_type": "Function",
"id": "CVE-2026-32249-d16dffd7",
"deprecated": false
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-32249.json"