{"id":"CVE-2026-73074","title":"Vim is an open source, command line text editor","summary":"Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copyin…","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-190"],"vendor":"vim","product":"vim","affected":["vim < 9.2.0841"],"patched":["vim 9.2.0841"],"published":"2026-08-11","updated":"2026-10-06","sourceUpdated":"2026-10-06T20:07:14.963","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73074","references":[{"url":"https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b","label":"security-advisories@github.com"},{"url":"https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73074.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-73074"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514035"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73074"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73074"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00098,"epssPercentile":0.00766,"ingestedAt":"2026-09-09T21:22:45.527Z","scores":{"nvd":6.7,"vendor":5.5},"slug":"CVE-2026-73074","body":"## Overview\n\nVim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.\n\n## Affected\n\n- `vim < 9.2.0841`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `vim 9.2.0841`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-06 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73074.json)","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":216707,"id":"CVE-2026-73074","ts":1791317838082,"field":"cvss","old":null,"new":"6.7"},{"seq":216706,"id":"CVE-2026-73074","ts":1791317838082,"field":"severity","old":"none","new":"medium"}]}