Medium [CVE-2026-73075] Out-of-bounds Access in Popup Opacity Handling
This medium-severity Red Hat Linux advisory covers CVE-2026-73075.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write.
This issue is fixed in version 9.2.0843. This vulnerability involves an out-of-bounds memory access within the popup opacity handling feature.
A local attacker could exploit this by using specially crafted Vim script, leading to an out-of-bounds read and a limited out-of-bounds write. While the editor is expected to continue functioning, this could potentially result in unexpected behavior or information disclosure.
Exploitation requires a local attacker to execute specially crafted Vim script that utilizes specific popup window features, making user interaction a prerequisite.
The impact is typically limited to an out-of-bounds read and a constrained write, which may lead to unexpected behavior but is not expected to result in immediate system compromise or arbitrary code execution. None of the Red Hat products ship this vulnerable code.
Hence, are not affected. Red Hat severity: Moderate — CVSS 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L).
Weakness: CWE-125.
- < 9.2.0469
- < 9.2.0843
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
- 9.2.0843
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
Mitigation checklist
- To mitigate this issue, users should avoid running untrusted Vim scripts or installing untrusted plugins. This vulnerability is triggered by the execution of malicious Vim script code, not merely by opening a file.
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.