CVE-2026-73073 @ Library

"CVE-2026-73073"
"vim-8.0.0197-4+deb9u7"
"vim-common-8.0.0197-4+deb9u7"
"vim-runtime-8.0.0197-4+deb9u7"
"vim-tiny-8.0.0197-4+deb9u7"
"vim-2:8.0.0197-4+deb9u7"
"vim-common-2:8.0.0197-4+deb9u7"
"vim-runtime-2:8.0.0197-4+deb9u7"
"vim-tiny-2:8.0.0197-4+deb9u7"
"Am I vulnerable?"

Status

new

Priority

3.84

Match score

4.0

Risk

RCE

CVSS

7.8 HIGH

Reason

cpe: vim; pkgs: vim; version: in-range: vim-8.0.0197-4+deb9u7, vim-common-8.0.0197-4+deb9u7, vim-runtime-8.0.0197-4+deb9u7, vim-tiny-8.0.0197-4+deb9u7; risk:rce

Created

2026-10-16T10:16:51Z

Updated

2026-10-20T10:18:00Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

Package	Commands
vim-8.0.0197-4+deb9u7
vim-common-8.0.0197-4+deb9u7
vim-runtime-8.0.0197-4+deb9u7
vim-tiny-8.0.0197-4+deb9u7
vim-2:8.0.0197-4+deb9u7
vim-common-2:8.0.0197-4+deb9u7
vim-runtime-2:8.0.0197-4+deb9u7
vim-tiny-2:8.0.0197-4+deb9u7

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: vim · vim-common · vim-runtime · vim-tiny

System	Matches	Ticket for CVE-2026-73073
Archive	vim-runtime 2:8.1.0875-5+deb10u6	new open
Janus	vim-runtime 2:8.1.0875-5+deb10u6	new open
Library	vim-runtime 2:8.0.0197-4+deb9u7	new open
Matrix	vim-runtime 2:9.0.1378-2+deb12u2	new open
Saiph	vim-runtime 2:8.1.0875-5+deb10u6	new open

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

Debian GNU/Linux 9 (stretch) (9) · debian

Arch

x86_64

kernel_release

uname -r → 4.9.0-19-amd64

kernel_version

uname -v → #1 SMP Debian 4.9.320-2 (2022-06-30)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
Matrix	new	3.84	2026-10-20T10:18:00Z	Open
Archive	new	2.67	2026-10-20T10:18:00Z	Open
Janus	new	2.67	2026-10-20T10:18:00Z	Open
Saiph	new	2.67	2026-10-20T10:18:00Z	Open

Description

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.

Update status

Add note only

References

NVD: CVE-2026-73073