CVE-2026-73075 in Vim
Summary
by MITRE • 08/11/2026
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability exists within the Vim text editor's popup window implementation where a specific function called popup_mark_opacity_zindex() in the src/popupwin.c file exhibits improper boundary checking when handling text-property-anchored popups with clipwindow and opacity settings. This flaw affects versions between 9.2.0469 and 9.2.0843, creating a potential security risk through memory access violations. The core issue manifests when the function calculates positioning for popup windows that are anchored to text properties while simultaneously using clipping windows and opacity effects.
The technical implementation defect stems from how the function handles window row calculations without properly accounting for the w_popup_topoff offset parameter. When a popup window is positioned with negative coordinates relative to the screen array, the code attempts to index before the valid memory boundaries instead of correctly adjusting for the top offset that should be applied. This results in an out-of-bounds read operation followed by a conditional write, creating potential data corruption or information disclosure scenarios. The vulnerability specifically impacts popup windows that are text-property-anchored, meaning they are positioned relative to specific text elements within the document rather than absolute screen coordinates.
This flaw represents a classic buffer overflow condition classified under CWE-125 as out-of-bounds read and potentially CWE-787 as out-of-bounds write, both of which fall within the ATT&CK framework's T1059.006 technique for command and scripting interpreter execution through vulnerable software components. The operational impact extends beyond simple memory corruption, as an attacker could potentially exploit this vulnerability to read sensitive data from adjacent memory locations or manipulate program flow through controlled conditional writes. The vulnerability is particularly concerning in environments where Vim is used with untrusted input or in automated processing scenarios.
Mitigation strategies should prioritize immediate patching to version 9.2.0843 which contains the necessary fix for this boundary checking issue. System administrators should also implement proper access controls and input validation when using Vim in multi-user environments, particularly when processing external content. Additional defensive measures include monitoring for unusual memory access patterns and implementing runtime protections such as address space layout randomization. The vulnerability demonstrates the importance of thorough boundary checking in graphical user interface components and highlights how seemingly minor offset calculations can lead to significant security implications in text editing software that handles complex window positioning scenarios.