A heap buffer overflow exists in Vim’s tag file resolution logic when processing the ‘helpfile’ option. The vulnerable get_tagfname() function copies the user-controlled helpfile value into a fixed-size heap buffer using an unsafe STRCPY() operation without bounds checking, which can corrupt memory and potentially allow an attacker to execute arbitrary code or crash the editor. The flaw arises when Vim parses help file tags.

Vim version 9.1.2131 and earlier are affected. The software is an open‑source command line text editor widely used on Linux, macOS, and Windows, and the vulnerability concerns the handling of the helpfile option for tag resolution.

The CVSS base score is 6.6, indicating medium severity, and the EPSS score is <1%, reflecting a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote configuration of the helpfile option, which an attacker could influence through environment settings or configuration files. Because a heap buffer overflow can lead to code execution, the potential impact is high should exploitation succeed.