CVE-2026-73074 in Vim
Summary
by MITRE • 08/11/2026
Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability identified in Vim versions prior to 9.2.0841 represents a critical heap-based buffer overflow condition that arises from improper handling of text property counts during the processing of text annotations. This flaw exists within the prop_add_one() function located in src/textprop.c, where the system fails to properly validate or constrain the proplen value obtained from get_text_props(). The underlying technical issue stems from an unchecked arithmetic operation that allows a uint16_t variable to overflow beyond its maximum representable value of 65535, causing the counter to wrap around to zero. This overflow condition creates a scenario where the system attempts to allocate heap memory based on a corrupted property count value, resulting in insufficient memory allocation for the actual number of text-property records that need to be copied.
The operational impact of this vulnerability extends beyond simple memory corruption, as it provides potential attackers with opportunities for arbitrary code execution within the context of the Vim process. When the system processes text containing extensive property annotations, the overflow causes the heap allocation to be sized incorrectly, leading to memory layout corruption and potentially enabling attackers to manipulate the heap structure to achieve privilege escalation or remote code execution. The vulnerability specifically affects the text property handling mechanism that is fundamental to Vim's functionality, making it particularly dangerous as it can be triggered through normal text editing operations involving annotated content.
Security researchers have classified this issue under CWE-129, representing an insufficient validation of the length of a buffer, while also aligning with ATT&CK technique T1059.008 for Command and Scripting Interpreter: Python and similar execution paths that leverage interpreter vulnerabilities. The vulnerability demonstrates how seemingly innocuous text processing operations can become attack vectors when proper bounds checking is absent from core system functions. The fix implemented in version 9.2.0841 addresses the root cause by introducing proper validation of the proplen value before using it to update the uint16_t counter, ensuring that the arithmetic operation remains within valid bounds and that subsequent heap allocations are correctly sized based on actual property counts rather than overflowed values.
Organizations utilizing Vim for text editing operations should prioritize immediate patching to version 9.2.0841 or later, as this vulnerability could be exploited in contexts where untrusted text content is processed through the editor. The attack surface expands when considering that many development environments and system administration tools rely on Vim or Vim-compatible editors, making this a potentially widespread concern. Security teams should also implement monitoring for unusual heap allocation patterns or memory corruption indicators when processing text files that contain extensive property annotations, as these may signal exploitation attempts targeting this vulnerability.