CVE-2026-45130
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Vim prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath.
Risk Assessment
An attacker can remotely execute arbitrary code in the context of the user opening a crafted text file in Vim, leading to full system compromise.
Recommendation
Update Vim to version 9.2.0450 or later, which includes a fix preventing heap overflow during spell file loading.
Other vulnerabilities in Vim
See all- CVE-2026-41411Medium
Vim is an open source command line text editor. Prior to 9.2.0357, a command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion; if it contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.
- CVE-2026-28422Low
Vim is an open-source command-line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.
- CVE-2026-28421Medium
Vim versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) in the swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file.
- CVE-2026-28420Medium
Vim, an open-source command-line text editor, prior to version 9.2.0076 contains a heap-based buffer overflow write and an out-of-bounds read in its terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.
- CVE-2026-28419Medium
Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer.
- CVE-2026-28418Medium
Vim is vulnerable to a heap-based buffer overflow out-of-bounds read in its Emacs-style tags file parsing logic prior to version 9.2.0074. When processing a malformed tags file, Vim can read up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue.
- CVE-2026-28417Medium
An OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.
- CVE-2026-26269Medium
A stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command. A malicious NetBeans server can overflow the 64-byte keybuf with a single specialKeys command. The issue is fixed in Vim patch v9.1.2148.
- CVE-2024-22667High
Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer passed down to the option callback functions.
- CVE-2017-11109High
Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file.
Original NVD description (English source)
Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS