# CVE-2026-32249: NFA regex engine NULL pointer dereference affects Vim < 9.2.0137 CVE-2026-32249 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2026-32249, released March 12, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-32249 - Priority: Routine - CVSS: 5.5 (Moderate) - EPSS: 0.0016 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 12, 2026 - Weakness: NULL Pointer Dereference - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32249 ## Description Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | vim Debian 13.5 (trixie) | 2:9.1.1230-2+deb13u1 | [DEBIAN-CVE-2026-32249](https://patchblox.com/security/data/fix/linux/debian-cve-2026-32249.md) | Mar 12, 2026 | | Linux | vim Debian 14 | 2:9.2.0218-1 | [DEBIAN-CVE-2026-32249](https://patchblox.com/security/data/fix/linux/debian-cve-2026-32249.md) | Mar 12, 2026 | | Linux | vim Ubuntu 24.04.5 LTS (noble) | 2:9.1.0016-1ubuntu7.11 | [vim 2:9.1.0016-1ubuntu7.11](https://patchblox.com/security/data/fix/linux/ubuntu-noble-vim-2-9.1.0016-1ubuntu7.11.md) | Apr 30, 2026 | | Linux | vim Ubuntu 25.10 (questing) | 2:9.1.0967-1ubuntu6.2 | [vim 2:9.1.0967-1ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-vim-2-9.1.0967-1ubuntu6.2.md) | Apr 30, 2026 | | Linux | vim-athena Ubuntu 24.04.5 LTS (noble) | 2:9.1.0016-1ubuntu7.11 | [vim-athena 2:9.1.0016-1ubuntu7.11](https://patchblox.com/security/data/fix/linux/ubuntu-noble-vim-athena-2-9.1.0016-1ubuntu7.11.md) | Apr 30, 2026 | | Linux | vim-athena Ubuntu 25.10 (questing) | 2:9.1.0967-1ubuntu6.2 | [vim-athena 2:9.1.0967-1ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-vim-athena-2-9.1.0967-1ubuntu6.2.md) | Apr 30, 2026 | | Linux | vim-common Ubuntu 24.04.5 LTS (noble) | 2:9.1.0016-1ubuntu7.11 | [vim-common 2:9.1.0016-1ubuntu7.11](https://patchblox.com/security/data/fix/linux/ubuntu-noble-vim-common-2-9.1.0016-1ubuntu7.11.md) | Apr 30, 2026 | | Linux | vim-common Ubuntu 25.10 (questing) | 2:9.1.0967-1ubuntu6.2 | [vim-common 2:9.1.0967-1ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-vim-common-2-9.1.0967-1ubuntu6.2.md) | Apr 30, 2026 | | Linux | vim-common amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | | Linux | vim-data amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | | Linux | vim-debuginfo amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | | Linux | vim-debugsource amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | | Linux | vim-default-editor amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | | Linux | vim-enhanced amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | | Linux | vim-enhanced-debuginfo amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | | Linux | vim-filesystem amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | | Linux | vim-gtk3 Ubuntu 24.04.5 LTS (noble) | 2:9.1.0016-1ubuntu7.11 | [vim-gtk3 2:9.1.0016-1ubuntu7.11](https://patchblox.com/security/data/fix/linux/ubuntu-noble-vim-gtk3-2-9.1.0016-1ubuntu7.11.md) | Apr 30, 2026 | | Linux | vim-gtk3 Ubuntu 25.10 (questing) | 2:9.1.0967-1ubuntu6.2 | [vim-gtk3 2:9.1.0967-1ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-vim-gtk3-2-9.1.0967-1ubuntu6.2.md) | Apr 30, 2026 | | Linux | vim-gui-common Ubuntu 24.04.5 LTS (noble) | 2:9.1.0016-1ubuntu7.11 | [vim-gui-common 2:9.1.0016-1ubuntu7.11](https://patchblox.com/security/data/fix/linux/ubuntu-noble-vim-gui-common-2-9.1.0016-1ubuntu7.11.md) | Apr 30, 2026 | | Linux | vim-gui-common Ubuntu 25.10 (questing) | 2:9.1.0967-1ubuntu6.2 | [vim-gui-common 2:9.1.0967-1ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-vim-gui-common-2-9.1.0967-1ubuntu6.2.md) | Apr 30, 2026 | | Linux | vim-minimal amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | | Linux | vim-minimal-debuginfo amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | | Linux | vim-motif Ubuntu 24.04.5 LTS (noble) | 2:9.1.0016-1ubuntu7.11 | [vim-motif 2:9.1.0016-1ubuntu7.11](https://patchblox.com/security/data/fix/linux/ubuntu-noble-vim-motif-2-9.1.0016-1ubuntu7.11.md) | Apr 30, 2026 | | Linux | vim-motif Ubuntu 25.10 (questing) | 2:9.1.0967-1ubuntu6.2 | [vim-motif 2:9.1.0967-1ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-vim-motif-2-9.1.0967-1ubuntu6.2.md) | Apr 30, 2026 | | Linux | vim-nox Ubuntu 24.04.5 LTS (noble) | 2:9.1.0016-1ubuntu7.11 | [vim-nox 2:9.1.0016-1ubuntu7.11](https://patchblox.com/security/data/fix/linux/ubuntu-noble-vim-nox-2-9.1.0016-1ubuntu7.11.md) | Apr 30, 2026 | | Linux | vim-nox Ubuntu 25.10 (questing) | 2:9.1.0967-1ubuntu6.2 | [vim-nox 2:9.1.0967-1ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-vim-nox-2-9.1.0967-1ubuntu6.2.md) | Apr 30, 2026 | | Linux | vim-runtime Ubuntu 24.04.5 LTS (noble) | 2:9.1.0016-1ubuntu7.11 | [vim-runtime 2:9.1.0016-1ubuntu7.11](https://patchblox.com/security/data/fix/linux/ubuntu-noble-vim-runtime-2-9.1.0016-1ubuntu7.11.md) | Apr 30, 2026 | | Linux | vim-runtime Ubuntu 25.10 (questing) | 2:9.1.0967-1ubuntu6.2 | [vim-runtime 2:9.1.0967-1ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-vim-runtime-2-9.1.0967-1ubuntu6.2.md) | Apr 30, 2026 | | Linux | vim-tiny Ubuntu 24.04.5 LTS (noble) | 2:9.1.0016-1ubuntu7.11 | [vim-tiny 2:9.1.0016-1ubuntu7.11](https://patchblox.com/security/data/fix/linux/ubuntu-noble-vim-tiny-2-9.1.0016-1ubuntu7.11.md) | Apr 30, 2026 | | Linux | vim-tiny Ubuntu 25.10 (questing) | 2:9.1.0967-1ubuntu6.2 | [vim-tiny 2:9.1.0967-1ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-vim-tiny-2-9.1.0967-1ubuntu6.2.md) | Apr 30, 2026 | | Linux | xxd Ubuntu 24.04.5 LTS (noble) | 2:9.1.0016-1ubuntu7.11 | [xxd 2:9.1.0016-1ubuntu7.11](https://patchblox.com/security/data/fix/linux/ubuntu-noble-xxd-2-9.1.0016-1ubuntu7.11.md) | Apr 30, 2026 | | Linux | xxd Ubuntu 25.10 (questing) | 2:9.1.0967-1ubuntu6.2 | [xxd 2:9.1.0967-1ubuntu6.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-xxd-2-9.1.0967-1ubuntu6.2.md) | Apr 30, 2026 | | Linux | xxd amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | | Linux | xxd-debuginfo amzn 2023 | 2:9.2.240-1.amzn2023.0.2 | [ALAS2023-2026-1584](https://patchblox.com/security/data/fix/linux/alas2023-2026-1584.md) | Apr 13, 2026 | --- Data as of 2026-11-10T01:44:33Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.