The vulnerability is a stack-buffer-overflow triggered inside the build_stl_str_hl() routine of Vim when a statusline containing a multi-byte fill character is rendered on a terminal that is very wide. The overflow can corrupt the call stack and potentially allow an attacker to execute arbitrary code, compromising the confidentiality and integrity of the system. The weakness is a classic stack-based buffer overflow.

Vim 9.2 and earlier versions before 9.2.0078 are affected. The issue is documented for the Vim editor, a widely used open‑source command‑line text editor, across all platforms where it is distributed.

The CVSS score is 2.2, indicating low severity, and the EPSS score is below 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local and requires an attacker to trigger the rendering of a specially crafted statusline in a terminal session where the terminal width is large enough to exploit the overflow. No remote exploitation vector is described, so the risk to users who do not alter statusline settings or use wide terminals remains low.