Executive brief
Vim is a widely used open-source text editor. A vulnerability in how it handles text properties could allow a specially crafted 'undo' file to cause the editor to crash or potentially leak sensitive information from memory. This occurs when a user opens a malicious file and performs an 'undo' action, which could disrupt operations or expose private data to an attacker.
Technical details
An out-of-bounds read vulnerability exists in Vim's text property handling within `src/textprop.c`. The function `get_text_props()` reads a 16-bit property count from a line's buffer but fails to validate this count against the actual remaining buffer size. An attacker can provide a crafted undo file (`.un~`) that, when loaded, specifies a large property count for a line with minimal data. Subsequent operations that iterate over these properties, such as screen redraws or `prop_list()` calls, will read past the allocated buffer. This can result in a denial-of-service (crash) or the disclosure of adjacent memory contents. The attack requires the 'undofile' feature to be enabled and user interaction to trigger an undo operation on a malicious file pair. The issue is resolved in version 9.2.0670.
Affected products
- Vim Vim < 9.2.0670
Timeline
- 2026-06-17: patched: Vim patch 9.2.0670 released
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: CVE published to NVD