CVE-2026-73075

A flaw was found in Vim, an open-source text editor. This vulnerability involves an out-of-bounds memory access within the popup opacity handling feature. A local attacker could exploit this by using specially crafted Vim script, leading to an out-of-bounds read and a limited out-of-bounds write. While the editor is expected to continue functioning, this could potentially result in unexpected behavior or information disclosure.

Moderate: This flaw in Vim involves an out-of-bounds memory access during popup opacity handling. Exploitation requires a local attacker to execute specially crafted Vim script that utilizes specific popup window features, making user interaction a prerequisite. The impact is typically limited to an out-of-bounds read and a constrained write, which may lead to unexpected behavior but is not expected to result in immediate system compromise or arbitrary code execution.

None of the Red Hat products ship this vulnerable code. Hence, are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.