Vim EUVD-2026-39441

Exploitation requires all of the following: (1) the target system runs Vim 9.2.0320-9.2.0678 compiled with the persistent_undo feature - standard in major distribution builds, confirmed by the test's CheckFeature persistent_undo guard; (2) a crafted undo file (.FILENAME.un~) or swap file is present on the filesystem at the path Vim will automatically probe when opening the associated base file; (3) the user actively opens that base file in Vim, triggering undo history restoration via um_goto_line() or virtual-text rendering via get_text_props(). Exploitation is limited by: local attack vector only (no network path exists); required active user interaction (the user must open the file); the crafted file must land at the exact undo/swap path Vim expects (not arbitrary filesystem write). The attack does not require any authentication or elevated privileges beyond write access to a directory the victim will open files from.

The CVSS 4.0 score of 6.8 accurately characterizes a moderate but not critical real-world risk. The local attack vector (AV:L) and required active user interaction (UI:A) are the principal mitigating factors - exploitation demands that an attacker place a crafted undo or swap file on the target filesystem AND induce the user to open the associated file in Vim. Neither a CISA KEV listing nor a confirmed third-party proof-of-concept was present in the provided intelligence, keeping urgency below patch-immediately thresholds. However, the fix commit's test functions (Test_textprop_undo_bad_vtext_offset and the revised ManipulateUndoBlob helper) supply a byte-for-byte construction guide for a malicious undo blob, meaning the gap to a functional exploit is narrow. The VA:H signal (high availability impact - crash) is confirmed by the commit's assertion that the pre-fix code causes an ASan abort. The VC:L (low confidentiality) signal reflects real risk: heap regions adjacent to the property buffer can hold credentials, editor buffers, or file contents. EPSS data was not included in the provided intelligence; exploitation probability cannot be quantitatively assessed from available signals.

An attacker embeds a crafted .FILENAME.un~ undo file alongside a legitimate file in a shared repository or archive download; the undo blob contains a single textprop_T entry with tp_id set to -1 (virtual text) and tp_text_offset set to 0x00100000 - far beyond the 34-byte property data. When a developer checks out the repository and opens the file in a vulnerable Vim, Vim automatically loads the undo file, restores the crafted line via um_goto_line(), and dereferences the out-of-range offset as a heap pointer, reading up to tp_len bytes of adjacent heap content (potentially exposing in-memory buffer contents or credentials) or crashing the editor. The fix commit's ManipulateUndoBlob test function provides byte-exact construction details, significantly reducing attacker skill requirements.