---
id: CVE-2026-73074
title: 'Vim is an open source, command line text editor'
summary: >-
  Vim is an open source, command line text editor. Prior to 9.2.0841,
  prop_add_one() in src/textprop.c uses the proplen value from get_text_props()
  to increment a uint16_t property count beyond 0xffff, wrapping the count to
  zero and copyin…
severity: none
cwe:
  - CWE-190
published: '2026-08-11'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:44:04.357'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73074'
references:
  - url: 'https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b'
    label: security-advisories@github.com
  - url: 'https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00108
epssPercentile: 0.01336
ingestedAt: '2026-09-09T21:22:45.527Z'
---

## Overview

Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.