CVE-2026-73074: 
Vim vulnerability analysis and mitigation

CVE-2026-73074 is a heap buffer overflow vulnerability in Vim caused by an integer wraparound in text property handling, affecting all versions prior to 9.2.0841. The flaw resides in prop_add_one() in src/textprop.c, where a uint16_t property count can wrap from 65535 to zero, causing existing text-property records to be copied into a heap allocation sized for none of them. It was reported by GitHub user @Wang1rrr, disclosed on July 23, 2026, and fixed in Vim 9.2.0841. The CVSS v3.1 base score is 5.5 (Medium), while the CVSS v4.0 base score is 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an integer overflow/wraparound (CWE-190) leading to a heap-based buffer overflow (CWE-122). Text properties in Vim's memline are stored in the layout [text][NUL][prop_count][textprop_T...][vtext...], where prop_count is a uint16_t. In prop_add_one(), the new count is computed as (uint16_t)(proplen + 1) without checking whether proplen has already reached 65535; when it has, the addition yields 65536, which truncates to zero in a uint16_t. The subsequent heap allocation is sized for zero property records, yet the copy loop uses the original proplen (65535) to copy all existing records into the undersized buffer, writing far past the allocation boundary. Exploitation requires Vim built with the textprop feature (included in the "huge" feature set used by most distributions) and 65,536 prop_add() calls on a single line, achievable via a crafted Vim script or a plugin processing attacker-controlled file content (GitHub Advisory, Patch Commit).

Successful exploitation results in an out-of-bounds heap write of attacker-influenced data (the existing textprop_T records), which typically causes a crash (denial of availability) and may be leveraged for arbitrary code execution with the privileges of the user running Vim. Confidentiality and integrity impacts are rated low to high depending on whether code execution is achieved. The attack is local and requires user interaction (opening or processing a crafted file), limiting the blast radius to the affected user's session rather than enabling direct lateral movement (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.108%, reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Reaching the 65535-property ceiling on a single line does not occur in normal use and requires either a purpose-built script or a plugin processing specially crafted input, raising the practical exploitation bar (GitHub Advisory).

1. Craft a malicious Vim script or file: Create a Vim script (.vim) or a file processed by a Vim plugin that calls prop_add() 65,536 times on a single line, using a registered property type (e.g., prop_type_add('overflow', {})), to saturate the uint16_t property count.
2. Trigger the overflow: When the 65,536th prop_add() call is made, prop_add_one() computes (uint16_t)(65535 + 1) = 0, allocating a heap buffer sized for zero property records.
3. Heap out-of-bounds write: The copy loop, driven by the original proplen value of 65535, writes all 65535 existing textprop_T records into the undersized buffer, corrupting adjacent heap memory with attacker-influenced data.
4. Achieve code execution or crash: Depending on heap layout and platform mitigations, the corruption may result in a crash (denial of service) or, with additional heap-shaping techniques, arbitrary code execution under the victim user's privileges (GitHub Advisory, Patch Commit).

• Process: Vim process crashing unexpectedly or producing segmentation faults when opening specific files or running particular scripts.
• Logs: System crash logs (e.g., /var/log/syslog, dmesg) showing segfaults or heap corruption errors attributed to the vim process; Vim error output containing E1580: Too many text properties on a single line (patched versions) or silent crashes (unpatched versions).
• File System: Presence of unusual .vim scripts or plugin files that call prop_add() in large loops; crafted files designed to trigger excessive text property additions when opened.
• Process Behavior: Unexpected child processes spawned from Vim (e.g., shells or network utilities) following the opening of a suspicious file, which may indicate successful code execution.

Update Vim to version 9.2.0841 or later, which adds a bounds check in prop_add_one() that rejects any attempt to add a text property when the count has already reached 65535, emitting error E1580 instead of overflowing (Patch Commit). Until patching is complete, avoid opening untrusted files with Vim, disable or audit plugins that use text properties with external data, and restrict execution of untrusted Vim scripts. Organizations using distribution-packaged Vim should monitor vendor channels (e.g., Red Hat, Alpine) for updated packages (Red Hat Bugzilla, Feedly).

The Vim project rated the advisory as "Moderate" severity and credited GitHub user @Wang1rrr for the responsible disclosure. The fix was authored by Yasuhiro Matsumoto and committed by Christian Brabandt as patch 9.2.0841. Red Hat opened a tracking bug and classified the issue as medium priority/severity. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking (GitHub Advisory, Red Hat Bugzilla).