CVE-2026-73075
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Vim, an open source command line text editor, from version 9.2.0469 to 9.2.0843 has a vulnerability in popup_mark_opacity_zindex() in src/popupwin.c that can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.
Risk Assessment
Risk of Vim editor crashes or potential code execution due to out-of-bounds read. The attack requires specially crafted files or input.
Recommendation
Update Vim to version 9.2.0843 or later. Avoid opening untrusted files in Vim.
Original NVD description (English source)
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.