Vim is an open source, command line text editor. Prior to 9.2.0670, gettextprops() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.
{
"cwe_ids": [
"CWE-125"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57451.json",
"cna_assigner": "GitHub_M"
}{
"cpe": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "9.2.0670"
}
],
"source": [
"AFFECTED_FIELD",
"CPE_RANGE",
"REFERENCES"
]
}
"2026-07-15T22:25:36Z"
[
{
"id": "CVE-2026-57451-15d4f0e4",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146200493773228420153804765641940418619",
"247548144377834636433589568706150705712",
"234273968612474424906542064803926360041",
"9680288734094375426198196597618295355"
]
},
"source": "https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79",
"target": {
"file": "src/version.c"
}
},
{
"id": "CVE-2026-57451-28236f0b",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150289743449562687144689520394935931397",
"68847642637674658768239492021187358724",
"252743089761683902423156314056437361515",
"249297061566247942872609600359221437370",
"233352102983837797572073848539464297118",
"182602631016174998348936266276400129636",
"290719596014176062847034900540734188450",
"260972575717083749318893252514150202659"
]
},
"source": "https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79",
"target": {
"file": "src/memline.c"
}
},
{
"id": "CVE-2026-57451-4c7bebdb",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2064.0,
"function_hash": "205459292935594607927718919289173294094"
},
"source": "https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79",
"target": {
"function": "adjust_text_props_for_delete",
"file": "src/memline.c"
}
},
{
"id": "CVE-2026-57451-5c914aa5",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1433.0,
"function_hash": "285902051098241014903256577159895914065"
},
"source": "https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79",
"target": {
"function": "um_goto_line",
"file": "src/textprop.c"
}
},
{
"id": "CVE-2026-57451-5fc8b14b",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159233145940899212613954214433672683363",
"192739413126164937506861976168500225823",
"267968685816933224056580836933536074774",
"228436684031385699808471419693516932968",
"88966837981011792077025567865954690296",
"123410944404236186500058244638052983586",
"57440961096431129123201729180630845249",
"95761148865542727920802456013401560733",
"320076294067081485518200394102375287118"
]
},
"source": "https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79",
"target": {
"file": "src/textprop.c"
}
},
{
"id": "CVE-2026-57451-6f90b834",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 604.0,
"function_hash": "268933202689072829874393060792750055069"
},
"source": "https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79",
"target": {
"function": "get_text_props",
"file": "src/textprop.c"
}
},
{
"id": "CVE-2026-57451-b2adf3e6",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 3661.0,
"function_hash": "69618662525947249082885974822421013774"
},
"source": "https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79",
"target": {
"function": "ml_delete_int",
"file": "src/memline.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57451.json"