{"id":"CVE-2026-57451","aliases":["ALPINE-CVE-2026-57451","AZL-91116","BELL-CVE-2026-57451","DEBIAN-CVE-2026-57451","EUVD-2026-39449","GHSA-f36c-2qcp-7gpw","MGASA-2026-0240","RHSA-2026:57614","UBUNTU-CVE-2026-57451"],"status":"published","title":"Vim: Out-of-bounds Read in Text Property Count","description":"Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00161,"percentile":0.05308,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-06-25T15:28:50Z","modified":"2026-11-03T06:32:56Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"vim","fixed_in":["9.2.0854-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vim","fixed_in":["9.2.0677-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"vim","fixed_in":["9.2.0735-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"vim","fixed_in":["9.2.0747-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"vim","fixed_in":["9.2.0747-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"vim","fixed_in":["9.2.0699-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vim","fixed_in":["2:9.2.0782-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0854-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0677-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0735-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0820-r2"},{"fixed":"9.2.0747-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.1415-r0"},{"fixed":"9.2.0747-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1395-r0"},{"fixed":"9.2.0699-r0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.2.0782-1"}]}],"versions":["2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1","2:9.2.0338-1","2:9.2.0355-1","2:9.2.0428-1","2:9.2.0461-1","2:9.2.0524-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.782-1.mga10"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:9","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.782-1.mga9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-default-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"xxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.967-1.1.hum1"}]}],"bundled":17}],"products":[{"vendor":"vim","product":"vim"}],"references":[{"url":"https://github.com/vim/vim/security/advisories/GHSA-f36c-2qcp-7gpw","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0670","tags":["x_refsource_MISC","Product","web","article"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-57451","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57451","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-57451","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57451.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-57451","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0240.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35580","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/22/13","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-3h95-3962-mmvf","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/29/5","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c","tags":["advisory","article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/30/4","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-47gw-8gc3-mgcm","tags":["advisory","article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/04/14","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468","tags":["advisory","article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/15/8","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/16/12","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/16/13","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/17/10","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/18/7","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-c4j9-wr9j-4486","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/20/2","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-x5fg-h5w9-9frf","tags":["advisory","article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/20/3","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-ww8h-47xp-hp4w","tags":["advisory","article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/21/1","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/21/2","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/24/9","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/27/6","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/28/1","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57614","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73073","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57451","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57453","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57454","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52860","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52858","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52859","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47167","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47162","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46483","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45130","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44656","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43961","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41411","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-35177","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34982","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39881","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57614.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455400","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34982","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/01/1","tags":["article"]},{"url":"https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0276","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455542","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35177","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35177","tags":["advisory"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456722","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39881","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0316","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461614","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41411","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41411","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0357","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460434","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43961","tags":["advisory"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468420","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44656","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44656","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0435","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45130","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0450","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477915","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46483","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46483","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0479","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487964","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47162","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47162","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0495","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487996","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47167","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0496","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487981","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52858","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0561","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52859","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0565","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487987","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52860","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/c8c63673bc4253212820626aeeb75999d9a539d2","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0597","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57451","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492967","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57453","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57453","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/b2cc9be119d51212bf0d3f2a99","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0678","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492977","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57454","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57454","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/b3faeecc976d3031d7c0675623516ec60c30f949","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0679","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517950","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73073","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73073","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/2f628d8104958fa7421664f792ca6d4f7a39a10f","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0845","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5g","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-57451","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-57451","title":"Vim: Out-of-bounds Read in Text Property Count","description":"Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.","status":"published","published":"2026-06-25T15:28:50.474Z","modified":"2026-06-25T16:04:53.21Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T13:43:44.898272Z"}],"euvd":[{"id":"EUVD-2026-39449","description":"Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.","status":"published","published":"2026-06-25T15:28:50Z","modified":"2026-06-25T16:04:53Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:25.700423Z"}],"nvd":[{"id":"CVE-2026-57451","description":"Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.","status":"published","published":"2026-06-25T16:16:42.263Z","modified":"2026-06-26T04:11:55.71Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:26.045561Z"}],"osv":[{"id":"ALPINE-CVE-2026-57451","description":"Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.","status":"published","published":"2026-06-25T16:16:42.263Z","modified":"2026-11-03T06:32:56.438896819Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BELL-CVE-2026-57451","status":"published","published":"2026-06-26T17:35:46.975325Z","modified":"2026-07-07T07:15:30.695033906Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-57451","title":"Vim: Out-of-bounds Read in Text Property Count","description":"Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.","status":"published","published":"2026-06-25T15:28:50.474Z","modified":"2026-10-28T10:55:37.606418765Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"DEBIAN-CVE-2026-57451","description":"Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.","status":"published","published":"2026-06-25T16:16:42.263Z","modified":"2026-10-01T03:03:27.442721791Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"RHSA-2026:57614","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-12T10:09:11Z","modified":"2026-10-17T10:16:12Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-57451","description":"Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.","status":"withdrawn","published":"2026-06-25T16:16:00Z","modified":"2026-07-01T03:42:31.836435575Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-91116","title":"CVE-2026-57451 affecting package vim for versions less than 9.2.0735-1","description":"Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.","status":"published","published":"2026-06-25T16:16:42Z","modified":"2026-08-28T17:56:26.369851Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"MGASA-2026-0240","title":"Updated vim packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nArbitrary Code Execution via Python Omni-Completion in Vim \u003c 9.2.0561.\n(CVE-2026-52858)\nOut-of-bounds Read in Terminal Screen Snapshot in Vim \u003c 9.2.0565.\n(CVE-2026-52859)\nArbitrary Code Execution via Python Omni-Completion in Vim \u003c 9.2.0597.\n(CVE-2026-52860)\nOut-of-bounds Write in Spell File Word Count in Vim \u003c 9.2.0653.\n(CVE-2026-55693)\nOut-of-bounds Write in Spell File Prefix Dump in Vim \u003c 9.2.0662.\n(CVE-2026-55892)\nVimscript Code Injection in netrw NetrwLocalRmFile() via crafted\nfilename affects Vim \u003c 9.2.0663. (CVE-2026-55895)\nOut-of-bounds Read in Text Property Count in Vim \u003c 9.2.0670.\n(CVE-2026-57451)\nOut-of-bounds Read with libsodium-encrypted Files in Vim \u003c 9.2.0671.\n(CVE-2026-57452)\nPowerShell Command Injection in zip.vim via Crafted Archive Entry Names\nin Vim \u003e 9.1.1783 \u0026\u0026 Vim \u003c 9.2.0678. (CVE-2026-57453)\nOut-of-bounds Read with Text Properties in Vim \u003e= 9.2.0320 \u0026\u0026 Vim \u003c\n9.2.0679. (CVE-2026-57454)\nOut-of-bounds Write in SOFO Soundfolding in Vim \u003c 9.2.0698.\n(CVE-2026-57455)\nArbitrary Code Execution via Python Omni-Completion Docstrings in Vim \u003c\n9.2.0699. (CVE-2026-57456)\n","status":"published","published":"2026-07-10T15:41:14Z","modified":"2026-07-10T15:45:04.007440114Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}