CVE-2026-73074: Vim Buffer Overflow Vulnerability

CVE-2026-73074 Overview

CVE-2026-73074 is a heap overflow vulnerability in Vim, the open source command line text editor. The flaw resides in prop_add_one() within src/textprop.c, where the proplen value returned by get_text_props() increments a uint16_t property counter beyond 0xffff. The counter wraps to zero, causing existing text-property records to be copied into a heap allocation sized for none of them. This integer overflow leads to memory corruption on the heap [CWE-190]. The issue is fixed in Vim version 9.2.0841.

Critical Impact
An attacker who convinces a user to open a crafted file in Vim can trigger heap memory corruption, potentially leading to arbitrary code execution in the user's context.

Affected Products

Vim (open source text editor) prior to version 9.2.0841
Any Linux, macOS, or Windows distribution shipping vulnerable Vim builds
Environments with the FEAT_PROP_POPUP feature compiled in

Discovery Timeline

2026-08-11 - CVE-2026-73074 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73074

Vulnerability Analysis

The vulnerability is a classic integer wraparound leading to a heap buffer overflow. Vim tracks text properties per line through prop_add_one() in src/textprop.c. The routine calls get_text_props() to obtain the current property count proplen, then increments it before allocating memory to hold the merged property records.

The property counter is stored in a uint16_t, which caps at 0xffff (65535). When more than 65535 text properties exist on a single line, the increment wraps the value back to zero. Vim then allocates a heap buffer sized against this zeroed count and copies the existing property records into it, writing far past the allocation boundary.

The result is out-of-bounds heap writes containing attacker-influenced text-property data. Depending on heap layout, this corruption can be leveraged to overwrite adjacent chunk metadata or function pointers.

Root Cause

The root cause is an unchecked integer increment on a 16-bit type. The code path did not validate that proplen + 1 remained within the representable range of uint16_t before using the result as an allocation size and copy count. This maps to [CWE-190] Integer Overflow or Wraparound.

Attack Vector

Exploitation requires local access and user interaction. A victim must open or process a maliciously crafted file (or buffer content) in Vim that induces more than 65535 text properties on a single line. Text properties can be injected through plugins, syntax processing, or scripted prop_add() calls embedded in modelines and startup files.

The patch introduces a new error, E1580: Too many text properties on a single line, aborting the operation before the overflow can occur.

#endif
EXTERN char e_completeopt_escape_cannot_be_used_with_nargs_underscore[]
	INIT(= N_("E1579: -completeopt=escape cannot be used with -nargs=_"));
#ifdef FEAT_PROP_POPUP
EXTERN char e_too_many_text_properties_on_a_single_line[]
	INIT(= N_("E1580: Too many text properties on a single line"));
#endif

Source: Vim commit a9336b47 — patch 9.2.0841 adds the guard message triggered before the wrap can occur.

Detection Methods for CVE-2026-73074

Indicators of Compromise

Vim processes crashing with SIGSEGV or glibc heap corruption messages (double free or corruption, malloc(): memory corruption) shortly after opening a file
Files or buffers containing an unusually large number of prop_add() invocations targeting a single line
Presence of E1580 errors in Vim logs on patched systems, indicating attempted exploitation blocked by the fix

Detection Strategies

Inventory installed Vim versions across endpoints and flag any build earlier than 9.2.0841
Monitor for Vim child process crashes correlated with recently opened files from untrusted sources such as email attachments or web downloads
Inspect Vim plugins and syntax scripts that programmatically add text properties in loops without bounds checks

Monitoring Recommendations

Enable core dump collection for interactive editor processes and forward heap corruption signatures to a central log store
Correlate Vim process termination events with file open telemetry to identify suspicious documents
Track package management events for Vim upgrades to confirm patch rollout across the fleet

How to Mitigate CVE-2026-73074

Immediate Actions Required

Upgrade Vim to version 9.2.0841 or later on all systems where it is installed
Apply distribution vendor updates as they become available for Debian, Ubuntu, RHEL, Fedora, Alpine, and other Linux distributions
Audit and disable untrusted Vim plugins that call prop_add() in unbounded loops
Instruct users to avoid opening untrusted files in Vim until patching completes

Patch Information

The fix is delivered in Vim patch 9.2.0841, tracked in GitHub Security Advisory GHSA-hm4g-pjfx-m27j and committed in Vim commit a9336b47. The patch adds error E1580 in src/errors.h and enforces the property count limit before allocation in src/textprop.c.

Workarounds

Disable text property features by using a Vim build without FEAT_PROP_POPUP where feasible
Set set nomodeline in /etc/vimrc to block file-embedded configuration that could trigger property additions
Restrict Vim to view-only mode (vim -R) when reviewing untrusted files, though this does not fully eliminate the property code path

bash

# Verify installed Vim version meets or exceeds the fix
vim --version | head -n 1

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade vim vim-runtime vim-common

# RHEL/Fedora
sudo dnf upgrade vim-enhanced vim-common vim-minimal

# Harden default configuration
echo 'set nomodeline' | sudo tee -a /etc/vim/vimrc