View at Official alpine advisory, NVD, CVE.org · CVE detail
Freshness: no update timestamp found; verify against the upstream OS advisory manually.
CVE-2026-34714: 1 source package rows (vim); 334 state rows across 7 repos (3.19-main, 3.20-main, 3.21-main, 3.22-main, 3.23-main, edge-community, edge-main); fixed 2, open 332.
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.