CVE-2026-73075: Vim Buffer Overflow Vulnerability

CVE-2026-73075 Overview

CVE-2026-73075 is an out-of-bounds read and conditional write vulnerability in Vim, the open source command line text editor. The flaw resides in the popup_mark_opacity_zindex() function within src/popupwin.c. Affected versions range from 9.2.0469 through 9.2.0842, with the fix landing in version 9.2.0843. The function can use a negative w_winrow value for a text-property-anchored popup that uses clipwindow and opacity, causing indexing before the screen array. The issue is tracked under [CWE-124: Buffer Underwrite ('Buffer Underflow')].

Critical Impact
A local user opening a crafted file or plugin configuration in Vim can trigger memory corruption through an out-of-bounds read and conditional write outside the screen buffer.

Affected Products

Vim versions 9.2.0469 through 9.2.0842
Vim distributions bundled with Linux, macOS, and BSD operating systems
Applications and workflows embedding vulnerable Vim builds

Discovery Timeline

2026-08-11 - CVE-2026-73075 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73075

Vulnerability Analysis

The vulnerability lives in Vim's popup window rendering logic. Specifically, the popup_mark_opacity_zindex() function in src/popupwin.c calculates screen positions using the popup's w_winrow field. When a popup is anchored to a text property and combines the clipwindow and opacity options, w_winrow can be negative. The function fails to account for w_popup_topoff, the offset that clips the top portion of the popup off-screen.

Using this negative row value, the function indexes into the screen buffer array before its starting address. This produces an out-of-bounds read of adjacent memory and, under certain conditions, a conditional write outside the intended buffer bounds.

The advisory carries a CVSS 4.0 base score of 4.6 and an EPSS probability of 0.117%, indicating limited attacker interest observed to date.

Root Cause

The root cause is missing bounds validation when combining a text-property-anchored popup with the clipwindow and opacity features. The rendering code assumes w_winrow is non-negative but does not adjust for w_popup_topoff when the anchored position pushes the popup above the visible screen. The resulting negative index maps to memory preceding the screen buffer.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a file, plugin, or configuration that instantiates a popup with the vulnerable option combination. When a user opens the content in a vulnerable Vim build, the render path triggers the out-of-bounds access. Practical impact centers on memory disclosure and process instability, with a narrow conditional write primitive that would need chaining with other bugs to gain code execution.

Refer to the GitHub Security Advisory for the maintainer's technical description of the affected code path.

Detection Methods for CVE-2026-73075

Indicators of Compromise

Unexpected Vim process crashes or segmentation faults when opening third-party files, plugins, or session configurations.
Vim configurations or plugin scripts that invoke popup_create() or popup_atcursor() with textprop, clipwindow, and opacity options combined.
Files delivered from untrusted sources that carry embedded modelines or plugin hooks referencing popup rendering.

Detection Strategies

Inventory installed Vim binaries and compare reported versions against the fixed release 9.2.0843.
Scan configuration directories such as ~/.vim/, ~/.config/nvim/, and system-wide plugin paths for scripts invoking the vulnerable popup option combination.
Enable core dumps in test environments and analyze crash reports for faults originating in popup_mark_opacity_zindex().

Monitoring Recommendations

Forward endpoint process telemetry for Vim crashes into centralized logging for correlation with recently opened files.
Alert on Vim invocations spawned by mail clients, browsers, or file managers, as these represent higher-risk entry points for crafted content.
Track package management events that install or update Vim to confirm patch rollout across the fleet.

How to Mitigate CVE-2026-73075

Immediate Actions Required

Upgrade Vim to version 9.2.0843 or later on all endpoints and servers.
Audit shared plugin repositories and dotfile distributions for popup configurations that combine textprop, clipwindow, and opacity.
Restrict opening of untrusted files in Vim until patched builds are deployed.

Patch Information

The issue is fixed in Vim version 9.2.0843. The patch adjusts popup_mark_opacity_zindex() to account for w_popup_topoff and prevent negative screen indexing. Details are published in the Vim GitHub Security Advisory GHSA-pmvp-6rcj-98p4. Linux distribution maintainers typically backport the fix, so apply vendor security updates as they become available.

Workarounds

Disable or remove plugins that create text-property-anchored popups using clipwindow combined with opacity until Vim is patched.
Launch Vim with vim -u NONE -N when opening untrusted files to bypass user configuration and plugin loading.
Set set nomodeline in vimrc to prevent file-embedded modelines from configuring popup behavior.

bash

# Verify installed Vim version and upgrade where required
vim --version | head -n 1

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade vim vim-common vim-runtime

# RHEL/Fedora
sudo dnf upgrade vim-enhanced vim-common vim-minimal

# Harden invocation for untrusted content
alias vimsafe='vim -u NONE -N -c "set nomodeline"'