CVE-2026-73075Low· 3.9▾ SunlitVim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 21.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
0.1% → 0.2%
Last analysed / modified upstream
— → 3.9
none → low
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.
vim >= 9.2.0469, < 9.2.0843Upgrade past the affected range:
vim 9.2.0843Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-2257High· 7.8Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
CVE-2022-0213Medium· 6.6vim is vulnerable to Heap-based Buffer Overflow
CVE-2022-2286High· 7.8Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
CVE-2022-2287High· 7.1Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
CVE-2022-2183High· 7.8Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CVE-2022-2206High· 7.8Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.