# CVE-2026-73074: Vim heap overflow in text property handling

Source: https://junglewise.ai/threats/cve-2026-73074-vim-heap-overflow-in-text-property-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73074 · Severity: info · CVSS 6.5 · Published 2026-08-11

Vim is a widely-used command-line text editor included with most Linux distributions and commonly extended with plugins. A flaw in its text property feature allows attackers to trigger a heap buffer overflow by adding more than 65,535 text properties to a single line, potentially crashing the editor or enabling further exploitation if triggered through a crafted file or malicious plugin.

Technologies: [Vim](https://junglewise.ai/threats/technologies/vim). Vendors: [Vim](https://junglewise.ai/threats/vendors/vim).

## Quick answers

**Is CVE-2026-73074 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73074 being exploited in the wild.

**How severe is CVE-2026-73074?** Informational severity, with a CVSS score of 6.5, published 11 August 2026.

**Which products and versions are affected?** Vim prior to 9.2.0841.

**Is there a fix for CVE-2026-73074?** A patch was published on 2026-07-23: Vim 9.2.0841 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73074 attacked?** It is attacked over the network or with local access.

**Am I affected by CVE-2026-73074?** Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap-based buffer overflow caused by an integer wraparound (CWE-190) in the prop_add_one() function in src/textprop.c. The function stores the count of text properties in a 16-bit unsigned integer; when the count reaches 65535 and another property is added, the increment wraps to zero, causing the size calculation for the buffer to reserve no space for property records. The existing property records are then copied into this undersized buffer, writing far past the allocation boundary. Exploitation requires the attacker to either provide a Vim script or craft input processed by a plugin that adds 65536+ properties to a single line. The vulnerability is fixed in Vim version 9.2.0841 and later.

## Affected products

- Vim Vim prior to 9.2.0841

## Timeline

- 2026-07-23: disclosed
- 2026-07-23: patched: Vim 9.2.0841

## References

- [https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b](https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b)
- [https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j](https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j)

## Related threats

- [Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim…](https://junglewise.ai/threats/cve-2026-73073-vim-is-an-open-source-command-line-text-editor-prior-to-9-2-0845)
- [Vim netrw code injection via menu construction](https://junglewise.ai/threats/cve-2026-73078-vim-netrw-code-injection-via-menu-construction)
- [Vim shell filetype plugin OS command injection via keyword lookup](https://junglewise.ai/threats/cve-2026-73077-vim-shell-filetype-plugin-os-command-injection-via-keyword-lookup)
- [Vim vimball arbitrary command execution via .VimballRecord](https://junglewise.ai/threats/cve-2026-73076-vim-vimball-arbitrary-command-execution-via-vimballrecord)
- [Vim out-of-bounds access in popup opacity handling](https://junglewise.ai/threats/cve-2026-73075-vim-out-of-bounds-access-in-popup-opacity-handling)