Executive brief
Vim is a widely used command-line text editor. A vulnerability in how it handles spell-check files could allow a specially crafted file to crash the application. To be affected, a user must open a malicious spell file and trigger a word list dump, which could lead to a denial of service or potential instability in the editor.
Technical details
A stack-based out-of-bounds write exists in the dump_prefixes() function within src/spell.c. The vulnerability is caused by a lack of bounds checking on a depth counter when walking a spell-file prefix trie. An attacker can provide a crafted .spl file containing self-referential nodes to drive the iterative walker beyond the fixed MAXWLEN-element stack arrays (prefix[], arridx[], and curi[]). This results in a stack corruption that crashes the editor. Exploitation requires the user to load the malicious spell file and execute a command that dumps the word list, such as :spelldump. The issue is fixed in version 9.2.0662.
Affected products
- Vim Vim < 9.2.0662
Timeline
- 2026-06-16: patched: Patch v9.2.0662 released
- 2026-06-25: disclosed: Public advisory published