Vim Command Line Text Editor Vulnerability Affecting Buffer Management
CVE-2026-73074

7.1HIGH

Key Information:

Vendor

Vim

Status
Vim
Vendor
CVE Published:
11 August 2026

What is CVE-2026-73074?

Vim, an open source command line text editor, has a buffer management issue where the function prop_add_one() in src/textprop.c improperly increments a uint16_t property count. This could lead to the count wrapping to zero, allowing for a heap allocation that does not account for existing text-property records. This mismanagement can potentially lead to further exploitation. The issue has been rectified in version 9.2.0841.

Affected Version(s)

vim < 9.2.0841

References

https://github.com/vim/vim/security/advisories/GHSA-hm4g-...
x_refsource_CONFIRM
https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5...
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.