Executive brief
Vim is a widely-used command-line text editor included with most Linux distributions and commonly extended with plugins. A flaw in its text property feature allows attackers to trigger a heap buffer overflow by adding more than 65,535 text properties to a single line, potentially crashing the editor or enabling further exploitation if triggered through a crafted file or malicious plugin.
Technical details
The vulnerability is a heap-based buffer overflow caused by an integer wraparound (CWE-190) in the prop_add_one() function in src/textprop.c. The function stores the count of text properties in a 16-bit unsigned integer; when the count reaches 65535 and another property is added, the increment wraps to zero, causing the size calculation for the buffer to reserve no space for property records. The existing property records are then copied into this undersized buffer, writing far past the allocation boundary. Exploitation requires the attacker to either provide a Vim script or craft input processed by a plugin that adds 65536+ properties to a single line. The vulnerability is fixed in Vim version 9.2.0841 and later.
Affected products
- Vim Vim prior to 9.2.0841
Timeline
- 2026-07-23: disclosed
- 2026-07-23: patched: Vim 9.2.0841