The flaw is a heap buffer overflow that occurs when the property count in Vim’s text‑property handling exceeds 0xffff. In prop_add_one() the code copies existing property records into an allocation sized for none of them, causing a wrap of a uint16_t counter to zero and corruption of heap memory. This overflow can be leveraged to execute arbitrary code locally or cause a denial of service by crashing the editor.

Vim, the open‑source command line text editor, is affected in all releases prior to 9.2.0841.

The CVSS base score of 7.1 indicates high severity. No EPSS rating is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an attacker supplying crafted input that triggers the addition of more than 65535 text properties while running Vim locally. While the description does not explicitly prove remote exploitation, the classic heap overflow nature suggests that an attacker with local or compromised shell privileges could elevate privileges or execute code.