CVE-2026-73074

An integer overflow in Vim's prop_add_one() function allows a local attacker to cause a denial of service or potentially execute arbitrary code by adding an excessive number of text properties to a single line.

This Moderate impact vulnerability in Vim's text property handling can lead to a heap buffer overflow. Exploitation requires a local attacker to provide specially crafted input, such as a malicious file or Vim script, that causes an integer wraparound. This scenario is not expected during normal use of the editor.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.