CVE-2026-73070

This CVE exposes a design failure in Vim's socket server that reflects a collapsed threat model rather than a novel vulnerability. The server was implemented using standard Unix primitives—fd_set with FD_SETSIZE (1024)—under an implicit assumption that local processes connecting to the editor socket would be cooperating and benign. That assumption held when Vim ran on single-user workstations. It does not hold in containerized development environments, shared CI runners, or any context where untrusted code or multiple automated processes share a host. The fd_set overflow isn't merely a DoS vector. The corruption occurs on the stack and is content-dependent—different buffer layouts and session state can produce different exploitation outcomes beyond simply crashing the Vim server. The CVSS 6.8 rating captures technical exploitability, not operational blast radius. A Vim process in a modern development workflow typically holds access to SSH agents, git credentials for production repositories, CI/CD tokens, and environment variables for VPNs. A corrupted editor process becomes a pivot point to every system that session could reach. The patch in version 9.2.0842 adds a connection limit, but the nature of that limit matters. A hardcoded ceiling can be enumerated and bypassed; a configurable one creates ergonomic pressure that may drive users to disable the feature entirely—trading a bounded vulnerability for an unbounded one. Verify which approach Vim 9.2.0842 implements and whether that limit interacts poorly with legitimate tooling in your environment. For prioritization: assess whether your Vim instances run with credentialed access (most do), whether they operate in shared or containerized contexts (increasing), and whether the socket server feature is actively used in your workflows. If the server is dead code in your deployment, the risk calculus differs from an environment where it's actively employed. The vulnerability was likely present for decades; the deployment context that makes it exploitable is recent.

Reviewed through automated stages and approved by a human before publication.