CVE-2026-73075: 
Vim Analyse et atténuation des vulnérabilités

CVE-2026-73075 is an out-of-bounds read and conditional write vulnerability in Vim's popup window opacity handling, affecting versions 9.2.0469 through 9.2.0842. The flaw exists in popup_mark_opacity_zindex() within src/popupwin.c, where a negative w_winrow value for a text-property-anchored popup with clipwindow and opacity options causes the function to index before the start of a heap-allocated screen array. The vulnerability was reported by @tdjackey, published on July 23, 2026, and fixed in version 9.2.0843. It carries a CVSS v4.0 base score of 4.6 (Medium) (GitHub Advisory).

The root cause is classified as CWE-124 (Buffer Underwrite / Buffer Underflow) and CWE-125 (Out-of-bounds Read). The popup_mark_opacity_zindex() function fills an array tracking the highest z-index of opacity popups per screen cell, computing cell offsets as row * screen_columns + column. When a clipwindow popup is anchored to a text property and the host window is scrolled so the anchor moves above the visible area, w_winrow becomes negative by design — but the loop over popup rows lacked a lower bound, allowing negative offsets into the heap array. The out-of-bounds write occurs conditionally: the 16-bit z-index value is written only when the value already present at the (pre-array) memory location is smaller than the popup's z-index, meaning the write can raise but not arbitrarily set the affected memory. Exploitation requires Vim script that combines the clipwindow, opacity, and text-property anchor options with a scrolled host window, making it reachable via plugins or user-run scripts but not via modelines or simply opening a file (GitHub Advisory).

Successful exploitation results in a read outside the bounds of a heap array and a conditional 16-bit write before the array's start. In a default Vim layout, the affected memory offsets fall into a neighboring array used for the popup mask, so the editor typically continues running silently without a crash. The constrained nature of the write (only raising values, not setting arbitrary ones) limits the practical impact, but memory corruption could theoretically affect editor stability or, in edge cases, influence adjacent data structures. There is no direct confidentiality impact, and the vulnerability does not enable remote code execution or privilege escalation (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-73075. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The NVD SSVC assessment confirms exploitation is rated as "none" and the vulnerability is not automatable, as it requires active user interaction — specifically, a user must run a crafted Vim script that creates a popup with clipwindow, opacity, and a text-property anchor in a scrolled host window (GitHub Advisory).

1. Craft a malicious Vim script: Write a Vim script that creates a popup window using the popup_create() function with the clipwindow, opacity, and text-property anchor options configured together.
2. Set up the host window: Ensure the popup's host window contains a text property anchor near the top of the buffer, so that scrolling the window upward will move the anchor above the visible area.
3. Trigger the negative w_winrow: Scroll the host window upward so the text-property anchor leaves the visible area, causing the popup's w_winrow to become negative.
4. Trigger the vulnerable code path: Any Vim redraw operation (e.g., screen refresh) will invoke popup_mark_opacity_zindex(), which iterates popup rows without a lower bound, computing a negative array offset.
5. Out-of-bounds access occurs: The function reads from and conditionally writes a 16-bit z-index value to memory before the start of the heap-allocated screen array, affecting adjacent memory (typically the popup mask array in default layouts) (GitHub Advisory).

The vulnerability is fixed in Vim version 9.2.0843, which corrects the issue by ensuring w_winrow always refers to the first visible row and records clipped rows only in the separate top offset, eliminating the need for consumers to clamp the value. Users running Vim versions 9.2.0469 through 9.2.0842 should upgrade to 9.2.0843 or later. As a workaround, avoid running untrusted Vim scripts or plugins that use the combination of clipwindow, opacity, and text-property-anchored popups (GitHub Advisory).