Medium [CVE-2026-73074] Heap buffer overflow via integer wraparound in text property handling

Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them.

This issue is fixed in version 9.2.0841. An integer overflow in Vim's prop_add_one() function allows a local attacker to cause a denial of service or potentially execute arbitrary code by adding an excessive number of text properties to a single line.

This Moderate impact vulnerability in Vim's text property handling can lead to a heap buffer overflow. Exploitation requires a local attacker to provide specially crafted input, such as a malicious file or Vim script, that causes an integer wraparound.

This scenario is not expected during normal use of the editor. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H).

Weakness: CWE-190. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4 as not affected.