CVE-2026-57451: Vim Text Editor Buffer Over-Read Vulnerability in Undo Files

Technical summary

The vulnerability resides in the get_text_props() function in src/textprop.c. This function reads a uint16 property count that is embedded inline after a line's text data and interprets it as the number of consecutive 32-byte textprop_T structures. The code performs only a floor check to ensure room for a single entry but does not validate the count against the actual buffer length. A line declaring a large count while containing insufficient data will cause out-of-bounds reads into adjacent memory. The flaw can be triggered via a crafted undo file (.un files), leading to information disclosure or crash. The issue was patched in version 9.2.0670.

Business impact

This vulnerability primarily affects availability. While the direct impact is a crash (denial of service), the out-of-bounds read could theoretically leak sensitive data from memory before the crash occurs. For organizations relying on Vim for critical editing workflows, unexpected crashes disrupt productivity. The attack surface is limited to users who open untrusted undo files, but the barrier to exploitation is low since undo files are binary artifacts that may be shared or cached without obvious risk signals.

Affected systems

Vim versions prior to 9.2.0670 are affected. The vulnerability affects all platforms where Vim runs (Linux, macOS, Windows, and others). Users who rely on undo file functionality are at highest risk, particularly those working in environments where undo files from external sources are encountered or synchronized across systems.

Exploitability

Exploitation requires user interaction: an affected user must open or process a malicious undo file. The CVSS vector reflects local access (AV:L), high complexity (AC:H), no privilege requirement, and user interaction. The technical barrier is low—crafting a malicious undo file requires only knowledge of the binary format and the property count field. However, social engineering is necessary; this is not a network-exploitable flaw. The vulnerability does not appear on the KEV catalog, suggesting no active exploitation in the wild at publication time.

Remediation

Update Vim to version 9.2.0670 or later. Users unable to update immediately should avoid opening undo files from untrusted sources. Undo files are typically stored in .vim/undo/ or similar locations; if possible, disable undo file persistence (set noundofile in your configuration) in high-risk environments until patching is completed. Organizations managing Vim deployments should prioritize patching in development and content-creation roles where undo functionality is heavily used.

Patch guidance

Verify that you are running Vim 9.2.0670 or later by executing :version in the editor. Binary distributions and package managers (apt, brew, rpm, etc.) should have updates available shortly after the official release. Compile from source if pre-built packages are not yet available; the fix is limited to textprop.c. Testing the patch by attempting to open a benign undo file will confirm the update took effect. No configuration changes are required post-patch.

Detection guidance

Monitor for Vim crashes in logs, particularly those coinciding with undo file access. End-user reports of unexpected editor crashes should be investigated for potential malicious undo file delivery. Network monitoring is less relevant since the attack is file-based, but watch for unusual .un file distribution through file sharing, email, or repositories. Endpoint detection could flag repeated Vim crashes or abnormal memory access patterns. Prior to patching, audit systems for suspicious .vim/undo/ directories, especially those containing recently modified or unexpectedly large files.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The MEDIUM severity (5.3 CVSS) reflects the user-interaction requirement and local-only attack vector, which significantly reduces real-world risk compared to network-exploitable flaws. However, the crash impact (availability) and the low barrier to exploitation if a malicious undo file circulates warrant inclusion in the next patch cycle. Organizations should prioritize this for developers, system administrators, and power users who frequently interact with undo files, while routine user instances can follow standard update schedules.

Risk score, explained

The CVSS 5.3 MEDIUM score balances several factors: the vulnerability requires local file access and user action (reducing likelihood), but causes high availability impact (crash). The low attack complexity reflects the straightforward nature of crafting a malicious file, not the difficulty of delivering it. No confidentiality impact is expected in typical scenarios, though the out-of-bounds read theoretically could leak data. The lack of KEV listing and apparent absence of in-the-wild exploitation suggest this remains a low-noise risk, suitable for standard remediation timelines rather than emergency response.

Frequently asked questions