CVE-2026-73074Medium· 6.7▾ SunlitVim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copyin…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
0.1% → 0.1%
Last analysed / modified upstream
— → 6.7
none → medium
Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.
vim < 9.2.0841Upgrade past the affected range:
vim 9.2.0841Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-2285High· 7.8Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.
CVE-2023-46246Medium· 4.0Vim is an improved version of the good old UNIX editor Vi
CVE-2022-2845High· 7.8Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.
CVE-2022-2849High· 7.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.
CVE-2022-2257High· 7.8Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
CVE-2022-2304High· 7.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.