Update Vim on Mac: Apple's 9.1.1752 Is 41 Advisories Behind

The Vim that comes with macOS reports itself as VIM - Vi IMproved 9.1 (2024 Jan 02, compiled Feb 21 2026) with Included patches: 1-1752. That's on this Mac mini, running macOS 26.4.1. Homebrew's vim formula is at 9.2.1150, built September 29, 2026. The gap is more than 1,500 patches. I wanted to know what that gap actually costs before telling anyone to update Vim on a Mac.

I checked it two ways. First, I took every security advisory the Vim project has published on GitHub and sorted out which ones apply to Apple's build. Then I ran both binaries through the same 19 behavior tests. The short version: 41 published advisories are fixed in a later Vim than Apple ships and apply to Apple's build. Feature-wise, Apple's 9.1 is closer to 9.2 than the version number suggests. And upgrading turns off one safety setting Apple has had in place since 2007.

This is part of my series on the tools macOS bundles, after update Git on Mac, update OpenSSL on Mac and nano on Mac.

52 advisories fixed after Apple's patch level

The vim/vim security advisories page listed 77 advisories when I pulled them through the GitHub API on 2026-10-12. For 52 of them, the first fixed version is later than 9.1.1752. They were published between December 2, 2025 and September 12, 2026. For Homebrew's 9.2.1150 the count is zero.

A version number alone doesn't make a build vulnerable, so I checked each of the 52 against what Apple's binary actually contains:

• 2 are Windows-only: the search-path RCE in the Windows installer and a PowerShell injection in zip.vim.
• 5 are in features Apple compiled out. Apple's vim --version shows -tabpanel, -socketserver, -sodium and -emacs_tags. That removes the tabpanel modeline escape (one of only three advisories rated high), the socket server overflow, the libsodium out-of-bounds read and two Emacs tags bugs.
• 3 came in with code added after 9.1.1752 (affected ranges start at 9.2.0320, 9.2.0469 and 9.2.0511).
• 1 is blocked by Apple's config. CVE-2026-34982, rated high, lets a crafted file run commands through a modeline when you open it. Apple's /usr/share/vim/vimrc sets modelines=0, with the comment " CVE-2007-2438, so the system Vim never reads modelines.

That leaves 41: 37 medium and 4 low. 23 are memory or injection bugs in Vim's C code, for example swap file recovery, spell file loading, the NFA regex engine, :terminal, text properties and glob(). The other 18 are in Vim scripts that Apple ships under /usr/share/vim/vim91: netrw (6), the Python, C and PHP omni-completion scripts (7), and zip.vim, tar.vim, vimball, the cucumber filetype plugin and the shell keyword lookup (1 each). For most of them the trigger is opening or browsing a file someone crafted for you.

One caveat: I can only read the version string. Apple could backport fixes without changing the patch number. Its release notes don't suggest it has. I went through the security notes for all 12 Tahoe releases, from 26.0.1 to 26.7.1. Vim shows up once, in macOS 26.1 (November 2025), for CVE-2025-53906, a zip.vim path bug fixed upstream in 9.1.1551. That matches the current 9.1.1752 build. Not one of the 11 releases since then mentions Vim, and that includes 26.5 through 26.7.1, which this Mac hasn't installed.

What 19 behavior tests showed

I didn't install Homebrew's Vim. I fetched its 14.7 MB bottle and libsodium's bottle, unpacked them into a work directory, pointed the library paths at the ncurses and gettext already on this machine, and re-signed the binary. Each test runs inside a detached tmux session with an empty HOME, so no user vimrc leaks in. The VIM and VIMRUNTIME variables point at the bottle's runtime. The commands run through -c 'source ...' after startup and write their results to a file. That way the test sees the same defaults a fresh user would.

Test	Apple 9.1.1752	Homebrew 9.2.1150
Modeline vim: set ts=3 in the file	Ignored (modelines=0, tabstop stays 8)	Applied (modelines=5, tabstop 3)
Syntax highlighting, incsearch, filetype on by default	All off	All on (defaults.vim loads)
"+ register to macOS clipboard, read back with pbpaste	Works	Works
:py3	E319: Sorry, the command is not available	Works, but only because [email protected] is installed here
:lua	E319	E370: Could not load library liblua5.5.dylib
:ruby	E319	E448: Could not load library function
:perl	E319	Works (links macOS's own Perl 5.34)
cryptmethod=xchacha20v2	E474: Invalid argument	Works
set vartabstop=4,8	Silently ignored, no error, value stays empty	Works
:profile start	E319	Works
showtabpanel (new in 9.2)	E518: Unknown option	Works
Vim9 enum, tuple types, completeopt fuzzy and nearest, :terminal	Work	Work

The 9.2 release coverage highlighted enums, tuples and fuzzy insert-mode completion. Apple's 9.1.1752 already runs all three, plus the nearest completion flag, because Vim adds features in patch releases and 9.2 mostly put a label on them. If you want to upgrade for 9.2's headline features, you may already have most of them. The real gap is in the compile-time features. Counting the + entries in vim --version, Apple's build has 86 and Homebrew's has 105. Apple's misses all four language interfaces, libsodium encryption, profiling, variable tab stops, right-to-left text, keymaps and clientserver.

The clipboard result surprised me. A lot of older advice says the system Vim can't reach the macOS clipboard. On 26.4.1 it reports +clipboard, and text yanked to the "+ register came back out of pbpaste. That worked even inside a tmux session started by a scheduled launchd job, with no one logged in at the screen.

The syntax highlighting question comes from the same file

"How do I enable syntax highlighting in vim on Mac?" has 62,163 views on Ask Different. The cause is the last line of /usr/share/vim/vimrc: let skip_defaults_vim=1. Stock Vim loads defaults.vim when you have no ~/.vimrc, and that turns on syntax, filetype detection, incsearch and a 5-line scrolloff. Apple's system vimrc skips it, so the system Vim opens with everything off. The top answer has it right: put source $VIMRUNTIME/defaults.vim at the top of your ~/.vimrc, then syntax on.

Homebrew's bottle doesn't ship a system vimrc, so both of Apple's settings go away at once. You get the defaults back, and modelines come back on. The modeline CVEs are fixed in 9.2.1150, so this isn't a hole today. But Apple turned modelines off for a reason that keeps coming back. The last two high-rated Vim advisories this year were both modeline escapes. If you liked that protection, add it to your own config:

" ~/.vimrc
source $VIMRUNTIME/defaults.vim
set nomodeline        " what Apple's /usr/share/vim/vimrc does with modelines=0

How to update Vim on a Mac

You can't replace /usr/bin/vim. It's on the sealed system volume, and an Ask Different thread about upgrading the system Vim (48,852 views) came to the same answer in 2016: install a second one and put it first in PATH. Homebrew's vim formula installs vim, vi, view, vimdiff, ex and xxd:

brew install vim
hash -r                     # the shell may still have /usr/bin/vim cached
type -a vim vi              # /opt/homebrew/bin entries must come first
vim --version | head -3     # 9.2, Included patches: 1-1150 (or later)

# optional, only if you use these plugins:
brew install [email protected]    # :py3 (needed by many completion plugins)
brew install lua            # :lua

The second block matters more than it looks. The formula's runtime dependencies are only libsodium, ncurses and gettext. Python, Lua and Ruby are build-time only, and its caveat says Additional features can be enabled by installing: lua, [email protected], ruby. On a clean Mac, :py3 in Homebrew's Vim fails until [email protected] is installed. That's the same version-pinning headache as this 2018 question, where a Python upgrade for Vim broke someone's TensorFlow setup. If you also maintain Python on the Mac, my update Python on Mac post covers the 3.9.6 that macOS ships. One thing to watch in the PATH step: git commit and crontab -e start whichever vi comes first in PATH, unless EDITOR is set. A 2019 thread shows how confusing two Vims on one PATH can get.

Is it worth it? If you open files from other people, archives, cloned repos or downloaded logs, yes. Of the 41 open advisories, 18 are in scripts that run when you browse or open those files. If all you do is edit your own config files over SSH, the risk is smaller, and Apple's modelines=0 is a sensible default to keep either way.

FAQ

What version of Vim comes with macOS?

On macOS Tahoe 26.4.1, /usr/bin/vim is Vim 9.1 with patches 1-1752, compiled February 21, 2026. Run vim --version to check yours. Homebrew's vim formula was at 9.2.1150 on October 12, 2026.

How do I update Vim on a Mac?

Run brew install vim, then hash -r, and confirm with type -a vim that /opt/homebrew/bin/vim comes before /usr/bin/vim. The system copy can't be replaced because it lives on the sealed system volume. Install [email protected] or lua separately if your plugins need :py3 or :lua.

Why doesn't Vim on Mac have syntax highlighting?

Apple's /usr/share/vim/vimrc sets skip_defaults_vim=1, so defaults.vim never loads and syntax, filetype detection and incsearch stay off. Add source $VIMRUNTIME/defaults.vim and syntax on to ~/.vimrc to fix it.

How this was checked: the 77 advisories came from the GitHub API for vim/vim on 2026-10-12. I sorted the 52 with a fix later than 9.1.1752 by hand against Apple's vim --version feature list and each advisory's affected range. The Apple release history comes from the 12 macOS Tahoe security pages linked from support.apple.com/100100. The behavior tests ran on 2026-10-12 on a Mac mini with macOS 26.4.1 (25E253): a tmux harness, empty HOME, results written to a file by Vim itself. Homebrew Vim 9.2.1150 was an unpacked bottle, not installed. Ask Different threads were read through the Stack Exchange API. The raw results are in my research notes for this post.