Executive brief
Vim is a widely used open-source text editor. A vulnerability in how it handles spell-check files allows a specially crafted file to cause the application to crash or potentially execute unauthorized code. To be affected, a user must open a malicious spell-check file and attempt to use the spell-suggestion feature.
Technical details
A stack-based out-of-bounds write exists in Vim's tree_count_words() function within src/spellfile.c. The vulnerability is caused by a lack of bounds checking on a depth counter used to index fixed-size stack arrays (arridx, curi, and wordcount) during the iterative traversal of a spell-file word trie. An attacker can provide a crafted .spl or .sug file containing cyclic geometries or deep forward-shared chains to exceed the MAXWLEN (254) limit. Exploitation requires the user to have spell-checking enabled and to trigger a spell suggestion (e.g., via 'z='). This results in stack corruption, leading to a crash or potential arbitrary code execution. The issue is resolved in version 9.2.0653 by enforcing depth limits during traversal.
Affected products
- Vim Vim < 9.2.0653
Timeline
- 2026-06-15: patched: Vim patch 9.2.0653 released
- 2026-06-15: advisory: GitHub Security Advisory GHSA-wgh4-64f7-q3jq published
- 2026-06-25: disclosed: CVE-2026-55693 published to NVD