Executive brief
Vim is a widely-used text editor that supports spell checking via spell files. A crafted spell file can trigger a heap buffer overflow in Vim's spell file parser, allowing an attacker who can trick a user into opening a malicious spell file to corrupt memory and potentially execute code or crash the editor.
Technical details
The vulnerability is a heap buffer overflow in the set_sofo() function in src/spellfile.c. The root cause is that sl_sal_first[] is reused without being reset between processing SN_SAL and SN_SOFO sections in a spell file. When a crafted spell file contains an empty SN_SAL section followed by an SN_SOFO section, the set_sofo() function under-counts multi-byte character mappings, allocates an undersized heap buffer, and writes past its end. The attack requires user interaction (opening a malicious spell file). The vulnerability was fixed in Vim 9.2.0846.
Affected products
- Vim Vim prior to 9.2.0846
Timeline
- 2026-08-11: disclosed
- 2026-07-24: patched: Fixed in Vim v9.2.0846