Vim's terminal emulator contains a heap-based buffer overflow WRITE and an out-of-bounds READ when it processes maximum combining characters from Unicode supplementary planes. These errors fall under CWE-122 and CWE-125. The overflow allows an attacker to corrupt memory, which could lead to crashes, data leakage, or, in the worst case, arbitrary code execution if the corrupted memory can be leveraged. The exact damage depends on the context in which Vim runs but memory corruption is inherently dangerous.

Affected products are all releases of the Vim text editor before version 9.2.0076. The fixed version 9.2.0076 and any later releases contain a patch that removes the vulnerable parsing logic. Vim is distributed under the Vim license and is commonly installed on Unix-like systems and Windows.

The CVSS base score of 4.4 indicates moderate impact. EPSS shows a probability of exploitation below 1 %, meaning real-world exploitation is currently very unlikely, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The vulnerability is most likely exploitable from a local context where an attacker can supply crafted Unicode input to Vim's terminal session; remote exploitation would require additional components that are not indicated in the description. Given the low EPSS, the risk to exposed environments is modest but upgrading remains prudent.