CVE-2026-73074CWE-190

CVE-2026-73074

Medium · published August 11, 2026

CVSS v3.1
6.7
EPSS
0%
Percentile
0.7
In the wild
Unconfirmed
What it is

Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00098 · 0.7th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-08-11T20:17Z
Affected products (1)
ProductVersionsFixed in
vim/vim< 9.2.08419.2.0841
References (2)
https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b · [email protected]https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j · [email protected]
EPSS history
Timeline
  • 11 AUG 15:35Z
    Vim: Heap Buffer Overflow in Text Property Handling
    cvelistv5