CVE-2026-57451 Vim: Out-of-bounds Read in Text Property Count

Medium 5.3 Published 25 Jun 2026 Updated 25 Jun 2026

An attacker can cause a crash in Vim by providing a crafted undo file that triggers an out-of-bounds read due to unchecked property counts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-57451?

CVE-2026-57451 is a medium-severity memory corruption vulnerability in Vim Vim, published on 25 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

Weakness: CWE-125

Which versions are affected by CVE-2026-57451?

It affects 1 product.

Products include Vim Vim.

How do I fix CVE-2026-57451?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-57451 being exploited?

There is no known exploitation of CVE-2026-57451 in the wild and no public exploit code.

All Vim Vim vulnerabilities

Sources

Also known as ALPINE-CVE-2026-57451, AZL-91116, BELL-CVE-2026-57451, DEBIAN-CVE-2026-57451, ECHO-f07e-8df7-39f4, GHSA-f36c-2qcp-7gpw and 1 more.