{"id":"CVE-2026-73075","summary":"Vim: Out-of-bounds Access in Popup Opacity Handling","details":"Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.","aliases":["GHSA-pmvp-6rcj-98p4"],"modified":"2026-08-13T08:22:35.703317Z","published":"2026-08-11T15:36:33.066Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-124","CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73075.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73075.json"},{"type":"ADVISORY","url":"https://github.com/vim/vim/security/advisories/GHSA-pmvp-6rcj-98p4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73075"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vim/vim","events":[{"introduced":"e3d9929109dadef35624ea7a68a6dbf0ca013f46"},{"fixed":"975e191dc817d8d00abca7197c4529a417c2f805"}],"database_specific":{"extracted_events":[{"introduced":"9.2.0469"},{"fixed":"9.2.0843"}],"source":"AFFECTED_FIELD"}}],"versions":["v9.2.0842","v9.2.0841","v9.2.0840","v9.2.0839","v9.2.0838","v9.2.0837","v9.2.0836","v9.2.0835","v9.2.0834","v9.2.0833","v9.2.0832","v9.2.0831","v9.2.0830","v9.2.0829","v9.2.0828","v9.2.0827","v9.2.0826","v9.2.0825","v9.2.0824","v9.2.0823","v9.2.0822","v9.2.0821","v9.2.0820","v9.2.0819","v9.2.0818","v9.2.0817","v9.2.0816","v9.2.0815","v9.2.0814","v9.2.0813","v9.2.0812","v9.2.0811","v9.2.0810","v9.2.0809","v9.2.0808","v9.2.0807","v9.2.0806","v9.2.0805","v9.2.0804","v9.2.0803","v9.2.0802","v9.2.0801","v9.2.0800","v9.2.0799","v9.2.0798","v9.2.0797","v9.2.0796","v9.2.0795","v9.2.0794","v9.2.0793","v9.2.0792","v9.2.0791","v9.2.0790","v9.2.0789","v9.2.0788","v9.2.0787","v9.2.0786","v9.2.0785","v9.2.0784","v9.2.0783","v9.2.0782","v9.2.0781","v9.2.0780","v9.2.0779","v9.2.0778","v9.2.0777","v9.2.0776","v9.2.0775","v9.2.0774","v9.2.0773","v9.2.0772","v9.2.0771","v9.2.0770","v9.2.0769","v9.2.0768","v9.2.0767","v9.2.0766","v9.2.0765","v9.2.0764","v9.2.0763","v9.2.0762","v9.2.0761","v9.2.0760","v9.2.0759","v9.2.0758","v9.2.0757","v9.2.0756","v9.2.0755","v9.2.0754","v9.2.0753","v9.2.0752","v9.2.0751","v9.2.0750","v9.2.0749","v9.2.0748","v9.2.0747","v9.2.0746","v9.2.0745","v9.2.0744","v9.2.0743","v9.2.0742","v9.2.0741","v9.2.0740","v9.2.0739","v9.2.0738","v9.2.0737","v9.2.0736","v9.2.0735","v9.2.0734","v9.2.0733","v9.2.0732","v9.2.0731","v9.2.0730","v9.2.0729","v9.2.0728","v9.2.0727","v9.2.0726","v9.2.0725","v9.2.0724","v9.2.0723","v9.2.0722","v9.2.0721","v9.2.0720","v9.2.0719","v9.2.0718","v9.2.0717","v9.2.0716","v9.2.0715","v9.2.0714","v9.2.0713","v9.2.0712","v9.2.0711","v9.2.0710","v9.2.0709","v9.2.0708","v9.2.0707","v9.2.0706","v9.2.0705","v9.2.0704","v9.2.0703","v9.2.0702","v9.2.0701","v9.2.0700","v9.2.0699","v9.2.0698","v9.2.0697","v9.2.0696","v9.2.0695","v9.2.0694","v9.2.0693","v9.2.0692","v9.2.0691","v9.2.0690","v9.2.0689","v9.2.0688","v9.2.0687","v9.2.0686","v9.2.0685","v9.2.0684","v9.2.0683","v9.2.0682","v9.2.0681","v9.2.0680","v9.2.0679","v9.2.0678","v9.2.0677","v9.2.0676","v9.2.0675","v9.2.0674","v9.2.0673","v9.2.0672","v9.2.0671","v9.2.0670","v9.2.0669","v9.2.0668","v9.2.0667","v9.2.0666","v9.2.0665","v9.2.0664","v9.2.0663","v9.2.0662","v9.2.0661","v9.2.0660","v9.2.0659","v9.2.0658","v9.2.0657","v9.2.0656","v9.2.0655","v9.2.0654","v9.2.0653","v9.2.0652","v9.2.0651","v9.2.0650","v9.2.0649","v9.2.0648","v9.2.0647","v9.2.0646","v9.2.0645","v9.2.0644","v9.2.0643","v9.2.0642","v9.2.0641","v9.2.0640","v9.2.0639","v9.2.0638","v9.2.0637","v9.2.0636","v9.2.0635","v9.2.0634","v9.2.0633","v9.2.0632","v9.2.0631","v9.2.0630","v9.2.0629","v9.2.0628","v9.2.0627","v9.2.0626","v9.2.0625","v9.2.0624","v9.2.0623","v9.2.0622","v9.2.0621","v9.2.0620","v9.2.0619","v9.2.0618","v9.2.0617","v9.2.0616","v9.2.0615","v9.2.0614","v9.2.0613","v9.2.0612","v9.2.0611","v9.2.0610","v9.2.0609","v9.2.0608","v9.2.0607","v9.2.0606","v9.2.0605","v9.2.0604","v9.2.0603","v9.2.0602","v9.2.0601","v9.2.0600","v9.2.0599","v9.2.0598","v9.2.0597","v9.2.0596","v9.2.0595","v9.2.0594","v9.2.0593","v9.2.0592","v9.2.0591","v9.2.0590","v9.2.0589","v9.2.0588","v9.2.0587","v9.2.0586","v9.2.0585","v9.2.0584","v9.2.0583","v9.2.0582","v9.2.0581","v9.2.0580","v9.2.0579","v9.2.0578","v9.2.0577","v9.2.0576","v9.2.0575","v9.2.0574","v9.2.0573","v9.2.0572","v9.2.0571","v9.2.0570","v9.2.0569","v9.2.0568","v9.2.0567","v9.2.0566","v9.2.0565","v9.2.0564","v9.2.0563","v9.2.0562","v9.2.0561","v9.2.0560","v9.2.0559","v9.2.0558","v9.2.0557","v9.2.0556","v9.2.0555","v9.2.0554","v9.2.0553","v9.2.0552","v9.2.0551","v9.2.0550","v9.2.0549","v9.2.0548","v9.2.0547","v9.2.0546","v9.2.0545","v9.2.0544","v9.2.0543","v9.2.0542","v9.2.0541","v9.2.0540","v9.2.0539","v9.2.0538","v9.2.0537","v9.2.0536","v9.2.0535","v9.2.0534","v9.2.0533","v9.2.0532","v9.2.0531","v9.2.0530","v9.2.0529","v9.2.0528","v9.2.0527","v9.2.0526","v9.2.0525","v9.2.0524","v9.2.0523","v9.2.0522","v9.2.0521","v9.2.0520","v9.2.0519","v9.2.0518","v9.2.0517","v9.2.0516","v9.2.0514","v9.2.0515","v9.2.0513","v9.2.0512","v9.2.0511","v9.2.0510","v9.2.0509","v9.2.0508","v9.2.0507","v9.2.0506","v9.2.0505","v9.2.0504","v9.2.0503","v9.2.0502","v9.2.0501","v9.2.0500","v9.2.0499","v9.2.0498","v9.2.0497","v9.2.0496","v9.2.0495","v9.2.0494","v9.2.0493","v9.2.0492","v9.2.0491","v9.2.0490","v9.2.0489","v9.2.0488","v9.2.0487","v9.2.0486","v9.2.0485","v9.2.0484","v9.2.0483","v9.2.0482","v9.2.0481","v9.2.0480","v9.2.0479","v9.2.0478","v9.2.0477","v9.2.0476","v9.2.0475","v9.2.0474","v9.2.0473","v9.2.0472","v9.2.0471","v9.2.0470","v9.2.0469"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73075.json","vanir_signatures_modified":"2026-08-13T08:22:35Z","vanir_signatures":[{"digest":{"function_hash":"288049855893294409637431516560309952300","length":965},"id":"CVE-2026-73075-12397462","signature_type":"Function","signature_version":"v1","source":"https://github.com/vim/vim/commit/975e191dc817d8d00abca7197c4529a417c2f805","target":{"file":"src/popupwin.c","function":"popup_apply_winupdate_clip"},"deprecated":false},{"id":"CVE-2026-73075-1548e196","signature_type":"Function","signature_version":"v1","source":"https://github.com/vim/vim/commit/975e191dc817d8d00abca7197c4529a417c2f805","target":{"function":"may_update_popup_mask","file":"src/popupwin.c"},"deprecated":false,"digest":{"function_hash":"30272984895680270696658679021013402471","length":4287}},{"deprecated":false,"digest":{"function_hash":"206260837722873793839915474296089613257","length":12007},"id":"CVE-2026-73075-1a251681","signature_type":"Function","signature_version":"v1","source":"https://github.com/vim/vim/commit/975e191dc817d8d00abca7197c4529a417c2f805","target":{"file":"src/popupwin.c","function":"update_popups"}},{"source":"https://github.com/vim/vim/commit/975e191dc817d8d00abca7197c4529a417c2f805","target":{"file":"src/version.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["146200493773228420153804765641940418619","217318619478952213304052858653982930233","256179388980949411515661824437426412659","86731316097373487092893144873604958043"]},"id":"CVE-2026-73075-1f7bba0c","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/vim/vim/commit/975e191dc817d8d00abca7197c4529a417c2f805","target":{"file":"src/popupwin.c","function":"popup_adjust_position"},"deprecated":false,"digest":{"function_hash":"100741796886487282347324984948167226265","length":12825},"id":"CVE-2026-73075-2ea7d15c"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["143639534335555166895058427252059836998","191695771079952620854461675161664346764","183849799653794071656214958351282743627","307912891069035491927864918094276181834","331030238865912959949639798956846436015","187508413999084309471103432782454682933","229681617873454959233233847251933904056","46539057199666433380865690516051805449","264950482842252929156869097410746415191","96856039987702045769171556811055420587","85443983995042743851349179895675270229","190555988252964297942508305709374065095","200922396652033396634458585075995738142","36372520388791639987889821655950515315","41312820124995676801069655509476522714","144029787755248221522735279188871037431","231367614890774271299626625211394122964","186016024974693516384803900555874441775","283513568304546455910597038737763236626","254444818273049380536136224313328953664","35736668251543677149468244147744266244","168489213824077504311381765989819133523","214873204348139141594788075205728757219","51092149604136102867984962525520983581","33798134322858692729198334589588277144","138174747154241988364347273826765840647","121001218299095285777238288483887222372","334450637190183325420540199338838274232","86377248446801532548688842509370829364","115321504172753709931281628308516536768","37998834238273285102075332100847606246","260420819261652498358104475515078259576","87644684971934162651501255090627785706","175736065022656180430796165996535952246"]},"id":"CVE-2026-73075-42d399d2","signature_type":"Line","signature_version":"v1","source":"https://github.com/vim/vim/commit/975e191dc817d8d00abca7197c4529a417c2f805","target":{"file":"src/popupwin.c"}},{"id":"CVE-2026-73075-5401cd45","signature_type":"Function","signature_version":"v1","source":"https://github.com/vim/vim/commit/975e191dc817d8d00abca7197c4529a417c2f805","target":{"file":"src/popupwin.c","function":"popup_mark_opacity_zindex"},"deprecated":false,"digest":{"length":632,"function_hash":"205132617776460362020236344622821414656"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}