CVE-2026-55892: Vim Spell-File Stack Buffer Overflow DoS Vulnerability

Technical summary

The dump_prefixes() function in src/spell.c processes a trie data structure used for spell-checking prefixes. The function uses a depth counter to track descent through the trie but never validates this counter against MAXWLEN, the size of three stack arrays (prefix[], arridx[], curi[]). A crafted .spl file can force unbounded recursion depth, causing an out-of-bounds write that corrupts the stack frame. The vulnerability is a CWE-787 (out-of-bounds write) triggered during spell-list dumping operations.

Business impact

For most users, this is a denial-of-service risk: a crafted spell file causes Vim to crash, disrupting work. Organizations using Vim for automated text processing, scripting, or CI/CD pipelines could face service interruption if an attacker introduces a malicious spell file into shared spell-check resources. The vulnerability requires user interaction (loading a specific file), so targeted attacks are most plausible in environments where spell files are shared or downloaded from untrusted sources.

Affected systems

Vim versions prior to 9.2.0662 are affected. The vulnerability is triggered when a user explicitly loads a crafted .spl spell file and runs a command to dump the word list (e.g., :spelldump). Systems running older Vim versions with spell-checking enabled are at risk if they process untrusted spell files.

Exploitability

Exploitability is straightforward but requires user interaction. An attacker must craft a malicious .spl file and either convince a user to load it or place it where it will be automatically loaded. The crash is deterministic and does not appear to enable code execution—it is limited to denial of service. No active exploitation in the wild has been documented, and the vulnerability does not appear on CISA's KEV list.

Remediation

Update Vim to version 9.2.0662 or later. Users unable to update immediately should avoid loading spell files from untrusted sources and consider disabling spell-checking if spell files are sourced externally. For automated or headless environments, review whether spell-checking is necessary and disable it if not in use.

Patch guidance

Vim maintainers have patched the vulnerability in version 9.2.0662 by adding bounds checking to the depth counter in dump_prefixes(). Verify the patch version against the official Vim release notes and apply it through your package manager (apt, brew, yum) or by rebuilding from source. If you maintain or distribute spell files, validate them after updating to ensure compatibility.

Detection guidance

Monitor for unexpected Vim crashes, particularly those correlating with spell-file loading or dumping operations. Log file analysis may show segmentation faults or abnormal termination. In development environments, watch for errors in spell-check initialization or custom spell-file sourcing. Intrusion detection systems can flag attempts to deliver .spl files through email or web downloads if your organization restricts such file types.

Why prioritize this

This vulnerability merits timely patching but is not critical. The CVSS 5.5 (Medium) rating reflects the requirement for user interaction and the denial-of-service impact (no code execution). Prioritize patching if your organization relies on Vim in automated workflows, CI/CD pipelines, or if users frequently receive spell files from external sources. Standard development and editing use cases are lower risk.

Risk score, explained

CVSS 3.1 score of 5.5 (Medium) reflects: local attack vector (AV:L) because the file must be on the user's system, low attack complexity (AC:L) since crafting the .spl file is straightforward, no privilege requirement (PR:N), user interaction required (UI:R) to load and dump the file, unchanged scope (S:U), and high availability impact (A:H) from the crash. The absence of confidentiality or integrity impact (C:N, I:N) and the interaction requirement keep the score moderate.

Frequently asked questions