CVE-2026-57451

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0670

Description The get text props() function in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop T entries that follow. Because the count is not verified against the actual amount of data present, a line declaring a large count with minimal data can cause the system to read beyond the end of the line buffer. This issue can be triggered via a crafted undo file, resulting in a crash.

Recommendations Update to version 9.2.0670.