Vim CVE-2026-73075

Exploitation requires that the affected Vim version (9.2.0469-9.2.0842) is running locally on the target system, and that the user opens or executes a Vim session (via a crafted file, script, or plugin) that simultaneously activates a text-property-anchored popup window configured with both the 'clipwindow' and 'opacity' options. This is a non-default, feature-specific configuration - standard Vim usage without these popup options is not affected. The CVSS 4.0 UI:A metric confirms that the user must actively perform an action (opening the triggering content) for exploitation to occur. Exploitation is limited to the scope of the Vim process itself (no scope change); no network access, elevated privileges, or remote delivery mechanism is involved.

The CVSS 4.0 score of 4.6 with vector AV:L/AC:L/AT:N/PR:N/UI:A accurately reflects the constrained threat model: exploitation requires local system access and active user interaction (the user must open or execute a Vim session triggering the specific popup configuration). The integrity and availability impacts are both rated Low, consistent with a conditional write and potential crash rather than arbitrary code execution. No EPSS score was provided in the intelligence data, limiting probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog, and no proof-of-concept code has been identified. The combination of local-only vector, mandatory user interaction, and a very specific feature configuration (text-property-anchored popup with clipwindow and opacity simultaneously enabled) substantially reduces real-world exploitation likelihood compared to the already-modest CVSS score. This is a genuine low-priority issue for most environments - the primary risk is crash-level denial of service to an individual Vim session, not system compromise.

A local user or a malicious file opened in Vim triggers a scenario where a text-property-anchored popup window is rendered with both the clipwindow and opacity options active, causing the popup's computed top row to become negative. This induces popup_mark_opacity_zindex() to index before the screen array boundary, resulting in a memory read from an out-of-bounds location and a potential conditional write, which could crash the Vim process or corrupt adjacent memory. No public proof-of-concept is known at time of analysis.