CVE-2026-55693: Vim Spell-File Stack Buffer Overflow Vulnerability

Technical summary

The vulnerability exists in the tree_count_words() function located in src/spellfile.c. This function traverses a word trie structure (a tree used to store spell-check dictionaries) iteratively, using a depth counter to track position within three fixed-size arrays: arridx[], curi[], and wordcount[], each bounded by MAXWLEN elements. The function never validates that the counter remains within array bounds. An attacker can construct a malicious spell file with an abnormally deep or circular trie structure that causes tree_count_words() to index far beyond the allocated array sizes. This results in a stack-based buffer overflow (CWE-787: Out-of-bounds Write), which overwrites adjacent stack frames and typically crashes the process. The fix, released in version 9.2.0653, implements depth validation to ensure the counter never exceeds safe limits.

Business impact

For organizations and users relying on Vim for development, system administration, or content creation, this vulnerability introduces a denial-of-service risk. An attacker could distribute a malicious spell file through package repositories, documentation sites, or social engineering, causing Vim to crash whenever the file is loaded. While crash-only impact may seem limited, the vulnerability could serve as a delivery mechanism for more sophisticated attacks in environments where Vim processes untrusted input or is integrated into automated workflows. Teams using Vim as part of CI/CD pipelines or configuration management systems face workflow disruption. The high CVSS score (7.8) reflects the potential for both information disclosure (through memory corruption before crash) and integrity impact, though practical exploitation for goals beyond denial of service is constrained by the crash nature of the flaw.

Affected systems

All Vim versions prior to 9.2.0653 are affected. This includes stable releases and patch versions up to 9.2.0652. The vulnerability is triggered when spell suggestion or spell-check features are invoked on a crafted .spl or .sug file, so systems with spell-checking disabled or those that never load external spell files face no practical risk. Notably, Vim 9.x versions are affected; earlier 8.x versions are also vulnerable but were not explicitly patched in the advisory—verify whether backport patches are available from your distribution. The flaw does not affect Vi or other editors, only Vim.

Exploitability

The attack requires user interaction: an end user must open or load a spell file in Vim. However, the barrier to user interaction is low. A social-engineering attack distributing a .spl file as a 'language pack' or 'custom dictionary' could successfully trigger the flaw. No additional privileges are required—a regular user can load a spell file. The crafted file itself is trivial to construct given knowledge of the spell-file format. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been confirmed at the time of publication, though this does not rule out future abuse. The local-attack-vector requirement (AV:L) limits scope somewhat, but in multi-user or shared-editor environments, or when users download spell packs from the internet, exploitability is straightforward.

Remediation

Upgrade Vim to version 9.2.0653 or later. This release includes bounds checking in tree_count_words() to prevent the depth counter from exceeding safe limits. Users unable to upgrade immediately should avoid loading spell files from untrusted sources and consider disabling spell-suggestion features if not essential. For administrators managing Vim deployments, prioritize patch deployment in development environments and shared systems where spell files may be accessed by multiple users or where external spell packs are installed.

Patch guidance

Apply the fix by updating Vim to 9.2.0653 or any patch release thereafter. Most Linux distributions (Ubuntu, Fedora, Debian, etc.) will release updated packages through their repositories; use your package manager to check for updates. macOS users via Homebrew can run 'brew upgrade vim'. Windows users should download the latest installer from vim.org or use a package manager like Chocolatey. Verify the installed version using 'vim --version' from the command line. If you maintain a custom Vim build, apply the patch from the official Vim repository commit that addresses tree_count_words() bounds validation. Test spell-check functionality after patching to ensure no regressions.

Detection guidance

Monitor for crashes of the Vim process, particularly when spell-suggestion features are in use. On systems with core dumps enabled, examine crash logs for stack overflow or segmentation fault errors in spellfile.c or tree_count_words(). If your environment uses endpoint detection and response (EDR) tools, configure them to alert on unexpected Vim crashes or memory access violations. For file-integrity monitoring, track unusual .spl and .sug files appearing in user spell directories (typically ~/.vim/spell on Unix-like systems or %APPDATA%\vim\spell on Windows). If you discover suspicious spell files, quarantine them and investigate their origin. Application allow-listing that restricts which Vim versions are executed can provide an interim control, though this is invasive and not a substitute for patching.

Why prioritize this

Despite the low likelihood of wild exploitation (not yet in KEV), the high CVSS score (7.8), ease of crafting malicious files, and low barrier to user interaction warrant prompt patching. Vim is ubiquitous among software developers and system administrators, making it a credible vector for targeted campaigns. The vulnerability is in a stable, supported release branch (9.2.x), not a legacy version, so patches are readily available and low-risk. Organizations should prioritize this update alongside routine patch cycles, especially for systems where developers or admins regularly work with external spell files or language packs.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a local attack vector (AV:L), low complexity (AC:L), no privilege requirement (PR:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The user-interaction requirement (UI:R) prevents a maximum score. The score appropriately captures the real-world risk: while local and requiring user action, the consequences are severe (crash and potential information leak), and triggering the flaw is trivial given a crafted file. The unchanged scope (S:U) means the vulnerability does not cross privilege or security boundaries, but the combination of ease and impact justifies the HIGH severity rating.

Frequently asked questions