GHSA-hm4g-pjfx-m27j: Vim: Heap Buffer Overflow in Text Property Handling

Q: Which Vim versions are affected?

Vim versions prior to 9.2.0841 are affected. The issue is fixed in version 9.2.0841.

Q: What conditions are required for exploitation?

The provided vector indicates local access, high attack complexity, no privileges required, and user interaction is required. Successful exploitation affects confidentiality, integrity, and availability.

Published Aug 11, 2026

Updated

Vim is an open source, command line text editor. Prior to 9.2.0841, propaddone() in src/textprop.c uses the proplen value from gettextprops() to increment a uint16t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.

Affected Software

1 affected component

vim Vim<9.2.0841

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vim to a version that resolves this vulnerability.
Fixed in 9.2.0841

Event History

Aug 11, 2026

CVE Published

via OSV·03:35 PM

Data Sourced

via OSV·03:35 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Vim versions are affected?

Vim versions prior to 9.2.0841 are affected. The issue is fixed in version 9.2.0841.

What conditions are required for exploitation?

The provided vector indicates local access, high attack complexity, no privileges required, and user interaction is required. Successful exploitation affects confidentiality, integrity, and availability.

GHSA-hm4g-pjfx-m27j: Vim: Heap Buffer Overflow in Text Property Handling

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Vim versions are affected?

What conditions are required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Vim versions are affected?

What conditions are required for exploitation?