Every CVE Search/ Get API key

CVE-2026-57451

Vim: Out-of-bounds Read in Text Property Count

5.3 MediumFix available

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
High

Exploit likelihood

0.16%Unchanged since Jun 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Vim: Out-of-bounds Read in Text Property Count

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

Record
CVE-2026-57451
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-39449 5.3

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

Record
EUVD-2026-39449
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
NVD 5.3

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

Record
CVE-2026-57451
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2026-57451 6.1

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

Record
ALPINE-CVE-2026-57451
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2026-57451 6.1
Record
BELL-CVE-2026-57451
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSV 5.3

Vim: Out-of-bounds Read in Text Property Count

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

Record
CVE-2026-57451
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-57451 6.1

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

Record
DEBIAN-CVE-2026-57451
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:57614 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:57614
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-57451 5.3

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

Record
UBUNTU-CVE-2026-57451
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVAZL-91116 No score

CVE-2026-57451 affecting package vim for versions less than 9.2.0735-1

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

Record
AZL-91116
Updated
2026-11-02
OSVMGASA-2026-0240 No score

Updated vim packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Arbitrary Code Execution via Python Omni-Completion in Vim < 9.2.0561. (CVE-2026-52858) Out-of-bounds Read in Terminal Screen Snapshot in Vim < 9.2.0565. (CVE-2026-52859) Arbitrary Code Execution via Python Omni-Completion in Vim < 9.2.0597. (CVE-2026-52860) Out-of-bounds Write in Spell File Word Count in Vim < 9.2.0653. (CVE-2026-55693) Out-of-bounds Write in Spell File Prefix Dump in Vim < 9.2.0662. (CVE-2026-55892) Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename affects Vim < 9.2.0663. (CVE-2026-55895) Out-of-bounds Read in Text Property Count in Vim < 9.2.0670. (CVE-2026-57451) Out-of-bounds Read with libsodium-encrypted Files in Vim < 9.2.0671. (CVE-2026-57452) PowerShell Command Injection in zip.vim via Crafted Archive Entry Names in Vim > 9.1.1783 && Vim < 9.2.0678. (CVE-2026-57453) Out-of-bounds Read with Text Properties in Vim >= 9.2.0320 && Vim < 9.2.0679. (CVE-2026-57454) Out-of-bounds Write in SOFO Soundfolding in Vim < 9.2.0698. (CVE-2026-57455) Arbitrary Code Execution via Python Omni-Completion Docstrings in Vim < 9.2.0699. (CVE-2026-57456)

Record
MGASA-2026-0240
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vim
Alpine:v3.23
 before 9.2.0854-r0
9.2.0854-r0
vim
Alpine:v3.24
 before 9.2.0677-r0
9.2.0677-r0
vim
Azure Linux:3
 before 9.2.0735-1
9.2.0735-1
vim
Alpaquita:23
 9.0.0820-r2 up to 9.2.0747-r0
9.2.0747-r0
vim
Alpaquita:25
 9.1.1415-r0 up to 9.2.0747-r0
9.2.0747-r0
vim
Alpaquita:stream
 9.0.1395-r0 up to 9.2.0699-r0
9.2.0699-r0
vim
Debian:14
 before 2:9.2.0782-1, plus listed versions
2:9.1.1230-22:9.1.1385-12:9.1.1766-12:9.1.1829-12:9.1.1846-1
Show 12 moreShow less
2:9.1.1882-12:9.1.2103-12:9.1.2141-12:9.2.0119-12:9.2.0136-12:9.2.0218-12:9.2.0315-12:9.2.0338-12:9.2.0355-12:9.2.0428-12:9.2.0461-12:9.2.0524-1
2:9.2.0782-1
vim
Mageia:10
From an advisory covering 12 CVEs
 before 9.2.782-1.mga10
9.2.782-1.mga10
vim
Mageia:9
From an advisory covering 12 CVEs
 before 9.2.782-1.mga9
9.2.782-1.mga9
vim
Red Hat:hummingbird:1
From an advisory covering 17 CVEs
 before 0:9.2.967-1.1.hum1
0:9.2.967-1.1.hum1
Show 8 moreShow less
Affected packages
PackageAffectedFixed
vim-X11
Red Hat:hummingbird:1
From an advisory covering 17 CVEs
 before 0:9.2.967-1.1.hum1
0:9.2.967-1.1.hum1
vim-common
Red Hat:hummingbird:1
From an advisory covering 17 CVEs
 before 0:9.2.967-1.1.hum1
0:9.2.967-1.1.hum1
vim-data
Red Hat:hummingbird:1
From an advisory covering 17 CVEs
 before 0:9.2.967-1.1.hum1
0:9.2.967-1.1.hum1
vim-default-editor
Red Hat:hummingbird:1
From an advisory covering 17 CVEs
 before 0:9.2.967-1.1.hum1
0:9.2.967-1.1.hum1
vim-enhanced
Red Hat:hummingbird:1
From an advisory covering 17 CVEs
 before 0:9.2.967-1.1.hum1
0:9.2.967-1.1.hum1
vim-filesystem
Red Hat:hummingbird:1
From an advisory covering 17 CVEs
 before 0:9.2.967-1.1.hum1
0:9.2.967-1.1.hum1
vim-minimal
Red Hat:hummingbird:1
From an advisory covering 17 CVEs
 before 0:9.2.967-1.1.hum1
0:9.2.967-1.1.hum1
xxd
Red Hat:hummingbird:1
From an advisory covering 17 CVEs
 before 0:9.2.967-1.1.hum1
0:9.2.967-1.1.hum1

History

History
RecordedChangedSources
affected, facts
affectedOSV
affected
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-57451 is a medium vulnerability (CVSS 5.3) in Vim, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in vim 9.2.0854-r0.

References

Show 147 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open