Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

A flaw in Vim allows an attacker to cause a Denial of Service (DoS) via an application crash. If a user opens a maliciously crafted undo file, an out-of-bounds read is triggered in the get_text_props() function due to missing length validation on property counts.

Exploitation requires specific user interaction; the vulnerability only triggers when a local user is tricked into opening a specially crafted undo file in Vim. This limits the attack surface to scenarios where untrusted files are intentionally processed Users are advised to avoid opening or processing undo files from untrusted or unknown sources. If your team compiles Vim from source, ensure standard compiler security flags (like -D_FORTIFY_SOURCE=2 or 3) are enabled. This provides a safety net by detecting out-of-bounds reads and safely terminating the application before exploitation can occur. Red Hat Enterprise Linux 10 Fix deferred vim Red Hat Enterprise Linux 6 Not affected vim Red Hat Enterprise Linux 7 Not affected vim Red Hat Enterprise Linux 8 Not affected vim Red Hat Enterprise Linux 9 Fix deferred vim Red Hat OpenShift Container Platform 4 Fix deferred rhcos https://www.cve.org/CVERecord?id=CVE-2026-57451 https://nvd.nist.gov/vuln/detail/CVE-2026-57451 https://github.com/vim/vim/commit/b2338ca90643e2f01ecb6547c1172716aaec4f79 https://github.com/vim/vim/releases/tag/v9.2.0670 https://github.com/vim/vim/security/advisories/GHSA-f36c-2qcp-7gpw