From Vim version 9.2.0469 to 9.2.0842, the function popup_mark_opacity_zindex() can use a negative w_winrow for a text‑property‑anchored popup that has clipwindow and opacity enabled. This results in an out‑of‑bounds read and a conditional write to the screen array, potentially exposing data or corrupting memory. The vulnerability is classified as a buffer under‑read (CWE‑124) and buffer under‑write (CWE‑125).

Vim (vim) versions 9.2.0469 through 9.2.0842 are affected. The issue is fixed in Vim 9.2.0843 and later. No other vendors or products are listed.

The CVSS score is 4.6, indicating a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is most likely local, requiring a user to launch Vim with a specially crafted popup that triggers the vulnerable path. While the vulnerability does not directly enable code execution, the out‑of‑bounds memory access can lead to information disclosure, program instability, or secondary exploitation. The exploitation complexity appears low, but the impact remains limited to the affected Vim instance.