CVE-2026-73075: 
Vim vulnerability analysis and mitigation

CVE-2026-73075 is an out-of-bounds access vulnerability in Vim's popup opacity handling, affecting versions 9.2.0469 through 9.2.0843 (exclusive). The flaw exists in popup_mark_opacity_zindex() within src/popupwin.c, where a negative w_winrow value for a text-property-anchored popup with clipwindow and opacity options causes indexing before the screen array bounds, resulting in an out-of-bounds read and conditional write. It was published on July 23, 2026, and fixed in version 9.2.0843. The vulnerability carries a CVSS v4.0 base score of 4.6 (Medium) (GitHub Advisory).

The root cause is classified as CWE-124 (Buffer Underwrite/Buffer Underflow) and CWE-125 (Out-of-bounds Read). The function popup_mark_opacity_zindex() fills a screen-sized array tracking the highest z-index of opacity popups per cell; the loop over popup rows was bounded above (by popup height and screen rows) but not below. When a clipwindow popup is anchored to a text property and the host window is scrolled so the anchor moves above the visible area, w_winrow becomes negative, causing the computed array offset (row × columns + column) to be negative — indexing memory before the heap array. The out-of-bounds write occurs conditionally: the 16-bit z-index value is written only when the value already present at the negative offset is smaller, meaning the write can raise but not arbitrarily set the affected memory. Exploitation requires Vim script that combines the clipwindow, opacity, and text-property anchor options with a scrolled host window, making it reachable via plugins or user-run scripts but not from opening a file or modelines (GitHub Advisory).

Successful exploitation results in a heap out-of-bounds read and a constrained out-of-bounds write of a 16-bit value. In a default Vim layout, the affected offsets fall into a neighboring array used for the popup mask, so the editor typically continues running silently without a crash. The integrity impact is limited — the write can only raise the value at the affected memory location, not set it arbitrarily — and there is no direct confidentiality impact. Availability impact is low, as the editor generally does not crash (GitHub Advisory).

There is no evidence of in-the-wild exploitation, and the NVD SSVC assessment confirms exploitation status as "none" and the vulnerability as non-automatable. The EPSS score is approximately 0.117%, indicating a very low probability of exploitation in the near term. No public proof-of-concept exploit code has been identified, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to scenarios where a user runs a specially crafted Vim script or plugin that combines specific popup options with a scrolled host window (GitHub Advisory).

1. Craft a malicious Vim script or plugin: Write a Vim script that creates a popup window using the clipwindow, opacity, and text-property anchor options simultaneously.
2. Set up the trigger condition: Ensure the host window is scrolled such that the text-property anchor moves above the visible area, causing the popup's w_winrow to become negative.
3. Execute the script: Convince the target user to run the malicious script or install the malicious plugin in a vulnerable Vim version (9.2.0469 ≤ version < 9.2.0843).
4. Trigger out-of-bounds access: When popup_mark_opacity_zindex() iterates over popup rows without a lower bound check, it indexes before the screen array, causing an out-of-bounds read and a conditional 16-bit write to adjacent heap memory.
5. Observe effect: In a default layout, the write silently corrupts the neighboring popup mask array; depending on heap layout, this could potentially influence editor behavior or be leveraged for further memory manipulation (GitHub Advisory).

• File System: Presence of unexpected or unfamiliar Vim plugin files (.vim scripts) in ~/.vim/plugin/, ~/.vim/autoload/, or system-wide Vim plugin directories that create popups with clipwindow, opacity, and text-property anchor options.
• Process: Vim processes exhibiting unexpected crashes or memory corruption symptoms (e.g., segmentation faults) when rendering popup windows.
• Logs: System logs (e.g., /var/log/syslog) showing Vim process crashes or abnormal termination signals (SIGSEGV, SIGABRT) correlated with popup rendering activity.

The fix is available in Vim version 9.2.0843, which corrects the popup row handling so that w_winrow always refers to the first visible row and clipped rows are tracked only in the separate top offset. Users should upgrade to Vim 9.2.0843 or later as the primary remediation. As a workaround, avoid running untrusted Vim scripts or plugins that use the combination of clipwindow, opacity, and text-property anchor popup options (GitHub Advisory).

The vulnerability was reported by researcher @tdjackey and acknowledged by the Vim project maintainer chrisbra in the GitHub Security Advisory. The advisory rates the severity as Moderate, consistent with the constrained nature of the out-of-bounds write. No significant broader media coverage or notable community debate has been identified beyond the standard vulnerability tracking feeds.