Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2026-73075: Vim may read or write beyond memory in pop‑up windows
CVE-2026-73075 · published 2 months ago
Summary
Versions of Vim from 9.2.0469 up to 9.2.0842 can mishandle the opacity setting for certain pop‑up windows, causing the program to look at or change data outside its normal memory area. This can lead to crashes or unpredictable behavior. Update Vim to version 9.2.0843 or later to resolve the issue.
What to do
- Update debian vim to version 2:9.2.0858-1.
- Update bellsoft vim to version 9.2.0854-r0.
- Update alpine vim to version 9.2.0854-r0.
- Update vim to version 9.2.0854-r0.
- Update vim vim to version 9.2.0843 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:14 | debian | vim |
< 2:9.2.0858-1 Fix: upgrade to 2:9.2.0858-1
|
| Alpaquita:23 | bellsoft | vim |
>= 9.0.0820-r2, < 9.2.0854-r0 Fix: upgrade to 9.2.0854-r0
|
| Alpaquita:25 | bellsoft | vim |
>= 9.1.1415-r0, < 9.2.0854-r0 Fix: upgrade to 9.2.0854-r0
|
| Alpaquita:stream | bellsoft | vim |
>= 9.0.1395-r0, < 9.2.0854-r0 Fix: upgrade to 9.2.0854-r0
|
| Alpine:v3.23 | alpine | vim |
< 9.2.0854-r0 Fix: upgrade to 9.2.0854-r0
|
| – | vim | vim |
>= 9.2.0469, < 9.2.0843 cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* |
| Alpine:v3.23 | – | vim |
>= 9.2.0469, < 9.2.0854-r0 Fix: upgrade to 9.2.0854-r0
|
Original advisory text
Vim: Out-of-bounds Access in Popup Opacity Handling
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.
References
- https://security-tracker.debian.org/tracker/CVE-2026-73075 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73075... Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-73075 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-73075 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-73075 Vendor Advisory
- https://github.com/vim/vim/security/advisories/GHSA-pmvp-6rcj-98p4 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-124Buffer Underwrite ('Buffer Underflow')
CWE-125Out-of-bounds Read
Timeline
Published11 Aug 2026
Updated21 Oct 2026
First seen11 Aug 2026
Sources
BELL-CVE-2026-73075 · OSV
DEBIAN-CVE-2026-73075 · OSV
CVE-2026-73075 · OSV
GHSA-pmvp-6rcj-98p4 · GHSA
ALPINE-CVE-2026-73075 · OSV
CVE-2026-73075 · NVD
Track software like this
Free during beta