CVE-2026-57451
Fixed in a distro release EPSS <1%CVSS 5.3
Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.
Products: vim
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.23 | vim | 9.2.0854-r0 |
| Amazon Linux 2023 | vim-common | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | vim-data | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | vim-default-editor | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | vim-enhanced | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | vim-filesystem | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | vim-minimal | 2:9.2.725-1.amzn2023.0.1 |
| Amazon Linux 2023 | xxd | 2:9.2.725-1.amzn2023.0.1 |
| Debian 14 | vim | 2:9.2.0782-1 |
| Red Hat hummingbird 1 | vim | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-X11 | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-common | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-data | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-default-editor | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-enhanced | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-filesystem | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | vim-minimal | 0:9.2.967-1.1.hum1 |
| Red Hat hummingbird 1 | xxd | 0:9.2.967-1.1.hum1 |