Vim contains a heap‑buffer overflow that is executed during swap file recovery. The bug is triggered when Vim parses unvalidated pointer blocks inside a swap file, causing memory corruption and a segmentation fault. Based on the description, it is inferred that an attacker who can supply a crafted swap file processed by Vim can force the editor to crash, thereby denying service to users who rely on Vim for editing or configuration.

The vulnerability affects the Vim text editor from the Vim project. All releases older than v9.2.0077 are vulnerable. Upgrading to v9.2.0077 or later removes the unsafe swap‑file recovery code.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation is unlikely at this time. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to inject a malicious swap file that Vim will read during recovery; typical vectors include local file placement or, in contexts where Vim processes user‑supplied files (such as web or version‑control services), remote delivery of crafted swaps. No evidence points to remote code execution or other higher‑impact capabilities beyond application crash.