Is CVE-2026-57451 actively exploited?

No active exploitation of CVE-2026-57451 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-57451 be exploited remotely?

No. CVE-2026-57451 requires local access to exploit.

What is the CVSS score of CVE-2026-57451?

CVE-2026-57451 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2026-57451

MEDIUM

CVE-2026-57451

CWE-125Published: June 25, 2026· Updated: Jun 26, 2026

6.1

CVSS v3.1

EPSS:0.11%probability of exploitation in 30 daysPercentile:1.7th

Official Description

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.

NVD Source

Technical Analysis

CVE-2026-57451 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 6.1.