Vim is an open source, command line text editor. Prior to 9.2.0841, propaddone() in src/textprop.c uses the proplen value from gettextprops() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.
{
"cwe_ids": [
"CWE-190"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73074.json",
"cna_assigner": "GitHub_M"
}[
{
"digest": {
"line_hashes": [
"95425663250854296238469118763355150216",
"121617579837735610202706309445170764320",
"121545549422921517412889482799214315516"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2026-73074-1d1a7ff1",
"signature_version": "v1",
"source": "https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b",
"signature_type": "Line",
"target": {
"file": "src/textprop.c"
}
},
{
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"305528383586550656065644332710190941523",
"177544562902061822647586437951421355345",
"15778833329428528312914768500914875578"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2026-73074-4f6ffae9",
"signature_version": "v1",
"source": "https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b",
"signature_type": "Line",
"target": {
"file": "src/version.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-73074-d10ec016",
"target": {
"file": "src/textprop.c",
"function": "prop_add_one"
},
"source": "https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b",
"signature_type": "Function",
"digest": {
"function_hash": "39522818732598320345787127143431904704",
"length": 4220.0
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73074.json"
"2026-08-14T08:08:30Z"