CVE-2026-73075
Received Received - Intake

Out-of-Bounds Read in Vim Text Editor via Popup Window

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73075
EUVD
EUVD-2026-56230

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vim vim From 9.2.0469 (inc) to 9.2.0843 (inc)
vim vim 9.2.0843

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-124 The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73075 is an out-of-bounds access vulnerability in Vim versions 9.2.0469 to 9.2.0843. It occurs when a popup window with the clipwindow option is anchored to a text property and the host window is scrolled so the anchor moves above the visible area. This causes the popup's window row to become negative, leading to an out-of-bounds read and conditional write outside the allocated array when the opacity option is used.

Detection Guidance

This vulnerability can only be triggered by specific Vim script commands creating popups with clipwindow and opacity options while the host window is scrolled. No direct network detection is possible. Check Vim version with 'vim --version' to see if it falls within 9.2.0469 to 9.2.0843.

Impact Analysis

The impact includes reading outside the bounds of a heap array and a conditional write of a 16-bit value outside it. Exploitation requires Vim script creating a popup with specific options and a scrolled host window, making it reachable from plugins or user scripts but not from opening a file.

Mitigation Strategies

Upgrade Vim to version 9.2.0843 or later immediately. If upgrading is not possible, avoid using popup windows with clipwindow and opacity options in Vim scripts until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73075. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart