CVE-2026-73075

Executive Summary

CVE-2026-73075 is an out-of-bounds read and conditional write vulnerability in the Vim text editor, affecting versions from 9.2.0469 up to (but not including) 9.2.0843. The flaw resides in the popup_mark_opacity_zindex() function in src/popupwin.c, which can compute a negative w_winrow for a text-property-anchored popup rendered with clipwindow and opacity enabled, causing the code to index before the beginning of the screen array. All users of affected Vim builds on Linux, macOS, Windows, and BSD are at risk; exploitation requires the victim to open or process crafted content, and the practical impact ranges from memory disclosure and denial of service to potential code execution in the context of the Vim process. At the time of writing, no CVSS score has been assigned, no public proof-of-concept exists, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

Vim's popup window subsystem manages floating windows rendered as part of the editor's screen model. A popup can be anchored to a text property, meaning its position is derived from the row and column of a property assigned to a buffer's text. When such a popup is combined with the clipwindow and opacity options, the renderer must compute the popup's on-screen placement and its opacity-related z-index. According to the NVD description, the affected function popup_mark_opacity_zindex() in src/popupwin.c selects a screen row based on the popup's window geometry. The root cause is that the function fails to account for the w_popup_topoff value — the vertical offset applied to a popup so that it is clipped correctly against the window boundary. Because of this omission, when a text-property anchor sits near or above the top edge of the visible area, the computed w_winrow becomes negative.

The negative w_winrow is subsequently used as an index into Vim's screen array, which stores character cells and attributes for the currently displayed screen. Indexing with a negative value reads memory located before the start of the array. The NVD description characterizes the write as "conditional," indicating that the corruption of adjacent memory only occurs under specific internal state conditions and is not guaranteed on every execution path. This behavior maps directly to CWE-124 (Buffer Underwrite — 'Buffer Underflow'), the weakness class describing writes or reads that occur before the beginning of a buffer. From a memory-safety perspective, the vulnerability is a classic sign/edge-condition bug: an unsigned or non-negative invariant (w_winrow >= 0) is violated because an offset term (w_popup_topoff) was not subtracted or clamped in the computation.

Technical detail on the exact call sequence is limited; the NVD description provides the affected function, source file, variables, and feature combination, but not a full stack trace or reproduction case. The vulnerable code path requires three conditions to align: (1) a popup must be anchored to a text property, (2) the popup must be rendered with the clipwindow option, and (3) opacity must be enabled for the popup. The combination of these factors drives execution into the flawed arithmetic. There is insufficient technical detail available to enumerate all triggering input formats; however, because text properties can be defined from Vim script content and buffer data, a crafted file or malicious Vim script delivered to a victim is the most plausible delivery mechanism. No vendor workaround is documented, and the only confirmed remediation is upgrading to version 9.2.0843 or later.

Exploitation Scenarios

No public proof-of-concept or exploit code is available; the attack chain below is inferred strictly from the vulnerability class and the conditions described in the NVD entry.

1. Reconnaissance and target identification. An attacker first determines whether the target's Vim build falls within the affected range (9.2.0469 through 9.2.0842). Version disclosure can occur locally via vim --version, or remotely if the target environment exposes Vim through an SSH session, a web-based terminal, or an embedded editor gadget. Given the lack of a network-accessible attack surface in Vim itself, the attacker shifts focus to the human factor: developers, system administrators, and DevOps engineers who routinely open untrusted files in Vim.

2. Trigger of the specific flaw. The attacker crafts a file or Vim script that, when opened by the victim, results in a popup window anchored to a text property positioned at or above the top edge of the visible screen area, with clipwindow and opacity enabled. Under these conditions, popup_mark_opacity_zindex() in src/popupwin.c computes w_winrow as a negative value because w_popup_topoff is not taken into account. The subsequent indexing operation reads before the screen array; a conditional write may also corrupt memory before the array.

3. Payload and execution method. At the vulnerability-class level, exploitation proceeds by controlling the magnitude of the negative index to influence which out-of-bounds memory is read or written. The out-of-bounds read leaks adjacent heap or data-segment contents, which could be used to defeat ASLR or disclose sensitive screen-buffer remnants. The conditional write, if reached, provides a primitive to corrupt a limited region of memory before the screen array; depending on the memory layout and the attacker's ability to influence neighboring allocations, this could escalate to control-flow redirection or arbitrary write. This escalation is theoretical and unproven.

4. Post-exploitation impact. In the worst case, successful exploitation yields code execution with the privileges of the user running Vim. In the more likely case, the vulnerability causes Vim to crash (segmentation fault), potentially losing unsaved work and disrupting terminal sessions. If Vim is invoked in privileged contexts (e.g., sudo vipw, visudo, or editing system files), a crash or compromise could have broader system integrity implications. The attacker's control over the content required to reach the vulnerable function implies the ability to deliver a localized, content-based attack — the typical vehicle being a malicious repository, a malicious Vim plugin, or a crafted document attachment.

It is acceptable to note that the absence of a PoC and the narrow triggering conditions currently make remote, weaponized exploitation unlikely; the EPSS score of 0.00117 (2.0% percentile) corroborates the low observed exploit activity.

Impact Assessment

CVE-2026-73075 is a local, client-side memory corruption issue with no official CVSS vector or subscores assigned (CVSS: N/A). Analysts assess the likely severity as Low-to-Medium on the CVSSv3 scale if one were assigned: the attack vector is local (the victim must open crafted content), privileges required are none beyond normal user access, but the vulnerability impacts confidentiality (out-of-bounds read of memory), integrity (conditional out-of-bounds write), and availability (process crash). The affected systems are every Vim distribution built from versions 9.2.0469 through 9.2.0842, spanning all major operating systems — Linux, Windows, macOS, and BSD variants. Because Vim is ubiquitous in server administration pipelines (crontab -e, git commit, visudo, container image editing), the blast radius is broad in terms of install base but narrow in terms of exploitability.

The business impact is dominated by supply-chain and phishing scenarios. A malicious actor who compromises a code repository or distributes a malicious Vim plugin could embed the triggering content, and any engineer who opens the file would be exposed. The conditional write reduces exploitability, but the out-of-bounds read is deterministic under the right geometry and can leak process memory, which may feed into higher-severity chained attacks. The CVE is not listed in CISA KEV, and no evidence of in-the-wild exploitation has been observed. Organizations should weigh the low EPSS percentile and absence of PoC against the simplicity of fixing the issue: a single version upgrade eliminates the exposure entirely.

Detection Guidance

Detection is inherently host-based because the vulnerability is triggered within the local Vim process and does not leave a distinctive network signature. The signatures below focus on abnormal Vim process termination, auditing events around memory faults, and heuristic content inspection of files that attempt to exercise Vim popup/text-property functionality. The Suricata rule targets the only network-observable phase — the delivery of crafted payload files via HTTP.

Sigma Rule

title: Vim Process Crash Indicative of Memory Corruption (CVE-2026-73075)
id: e6a9c1d4-7b03-4f0a-9b2e-3c6d8f1a7045
status: experimental
description: Detects abnormal termination (SIGSEGV) of Vim processes, which may indicate exploitation of out-of-bounds memory access in src/popupwin.c (CVE-2026-73075).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73075
author: Valters IT Threat Intelligence
date: 2026/06/01
logsource:
    category: process_termination
    product: linux
detection:
    selection_vim_crash:
        Image|endswith: '/vim'
        ExitCode: 139            # 128 + SIGSEGV
    filter_known_usage:
        CommandLine|contains: '--clean'
    condition: selection_vim_crash and not filter_known_usage
level: medium
falsepositives:
    - Vim crashing due to unrelated bugs or memory pressure
    - Custom builds of Vim or Neovim wrappers

YARA Rule

rule heur_cve_2026_73075_vim_popup_content
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Heuristic detection of crafted files/scripts attempting to exercise Vim text-property-anchored popups with clipwindow and opacity (CVE-2026-73075)."
        cve = "CVE-2026-73075"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73075"
        date = "2026-06-01"

    strings:
        $s_popup   = "popup" ascii nocase
        $s_clip    = "clip" ascii nocase
        $s_opacity = "opacity" ascii nocase
        $s_anchor  = "anchor" ascii nocase
        $s_textprop = "textprop" ascii nocase
        $s_winrow  = "winrow" ascii nocase
        $esc_seq   = { 1B 5D }  // ESC ] (terminal control)

    condition:
        filesize < 10MB
        and (3 of ($s_*) or (2 of ($s_popup, $s_clip, $s_opacity, $s_anchor) and #esc_seq > 5))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73075 Vim Popup OOB - Suspicious Text File Delivery"; flow:established,to_client; http.response_body; content:"popup"; nocase; content:"clip"; nocase; content:"opacity"; nocase; fileext:"txt"; classtype:attempted-user; sid:202673075; rev:1; reference:cve,2026-73075;)

Elastic Detection

process where event.type == "end" and process.name == "vim" and exit_code == 139

Splunk SPL Query

index=endpoint (process_name=vim OR Image=*vim*) (exit_code=139 OR status=SIGSEGV OR signal=11)
| stats count earliest(_time) latest(_time) by host, user, Image, CommandLine, exit_code
| where count >= 1

Wazuh OSSEC Rule

<group name="vim,cve-2026-73075,">
    <rule id="100731" level="10" frequency="1">
        <program_name>vim</program_name>
        <match>segfault|SIGSEGV|signal 11</match>
        <description>Vim process crashed with segmentation fault - potential CVE-2026-73075 exploitation attempt.</description>
        <mitre>
            <id>T1203</id>
        </mitre>
        <group>process_crash,memory_corruption,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED — a single source, OSV, reports the fix; not independently confirmed). The authoritative remediation is upgrading to Vim 9.2.0843 or later, which the NVD description explicitly states fixes the issue.

1. Immediate mitigations. No vendor workarounds are documented for this CVE. Until the patch can be applied, restrict the opening of untrusted files and Vim scripts from email attachments, web downloads, and third-party repositories. Where operationally feasible, launch Vim with -u NONE -i NONE --clean for untrusted content to reduce the likelihood of custom scripts defining text-property-anchored popups, and use view-only mode (vim -R) for documents of unknown provenance. Consider running Vim inside a sandbox (e.g., Firejail, bubblewrap, or an OS-level container) to contain any crash or memory-corruption fallout. Do not run Vim with elevated privileges (sudo) on untrusted files.

2. Patch and upgrade steps. Upgrade to Vim 9.2.0843 or newer from the official Vim project release channel, or from your distribution/vendor package repository as soon as an updated package is published. Verify the installed version with vim --version; builds reporting 9.2.0843 or later are patched. Since the patch is confirmed by a single source (OSV), after upgrading, validate the binary behaves normally and monitor the Vim project advisory channels for further confirmations or a revised advisory. If you maintain a custom Vim build from source, rebase to tag v9.2.0843 (or the current stable tag) and rebuild.

3. Long-term hardening. Treat text editors as part of the attack surface for client-side attacks: enforce a policy that all interactive file-editing tools receive security updates within a defined SLA, inventory editor versions across the enterprise, and feed crash/segfault telemetry from endpoint agents into the SIEM so that memory-corruption signals are visible. Educate development and operations staff about the risk of opening untrusted content in Vim and similar editors, and configure file-download proxies to block high-risk content types if the environment permits. Finally, revisit the use of third-party Vim plugins; plugins are the most plausible distribution channel for the text-property/popup constructs that trigger this flaw. Organizations with high-security requirements should consider removing plugins or mandating a review process for every plugin update.

References

1. NVD Entry — CVE-2026-73075: https://nvd.nist.gov/vuln/detail/CVE-2026-73075
2. OSV Vulnerability Record — CVE-2026-73075: https://osv.dev/vulnerability/CVE-2026-73075
3. OSV Package Snapshot (unfixed): e3d9929109dadef35624ea7a68a6dbf0ca013f46 — referenced in OSV; the fix is claimed in Vim version 9.2.0843: https://osv.dev/list
4. Vim Project Official Site and Release Information: https://www.vim.org/
5. CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaigns have been publicly attributed to CVE-2026-73075, and there is no evidence of exploitation in the wild as of the time of writing.