CVE-2026-57455: Vim Spell-Check Stack Buffer Overflow – Patch to 9.2.0698

Technical summary

The vulnerability exists in the spell_soundfold_sofo() function within src/spell.c, specifically in the single-byte branch that performs sound-folding transformations using a SOFO (sound-folding) byte map from spell files. The vulnerable code copies input bytes into a caller-provided stack buffer (size MAXWLEN) without validating the output index ri against bounds; the loop terminates only upon encountering a NUL terminator in the input stream. Words exceeding MAXWLEN length trigger unbounded writes past the stack buffer's end. This stack corruption corrupts the call frame, typically resulting in process termination. The vulnerability is classified as CWE-787 (out-of-bounds write).

Business impact

Vim users face service disruption when the editor crashes due to maliciously crafted spell files or excessively long words in spell-checking contexts. While the immediate risk is denial of service, stack corruption could theoretically provide a vector for privilege escalation or code execution if exploited with precision; however, the practical exploitation complexity is high and crashes are the primary observed outcome. Organizations relying on Vim for critical text editing workflows should prioritize patching to prevent unexpected editor crashes.

Affected systems

Vim versions prior to 9.2.0698 are affected. The vulnerability is triggered when spell-checking is active with a SOFO-based spell language loaded. Desktop and server environments running vulnerable Vim versions are at risk, particularly those with locally-accessible spell file directories or users who open untrusted documents with spell-checking enabled.

Exploitability

Exploitation requires local access and user interaction—an attacker must either provide a malicious spell file in a location Vim searches, or trick a user into opening a document containing an oversized word while spell-checking is active. The attack surface is moderate: spell-checking is a standard feature but often remains dormant unless explicitly invoked or configured. No network vector exists; this is strictly a local vulnerability requiring UI interaction to trigger.

Remediation

Update Vim to version 9.2.0698 or later. Verify the patch version against the official Vim release notes and security advisories. Until patching is complete, users can reduce risk by disabling spell-checking in untrusted contexts or restricting write access to spell file directories.

Patch guidance

Apply Vim version 9.2.0698 or later. Consult vim.org's official release notes and your distribution's package manager to confirm the exact patched version available in your environment. If using a distribution package, check the package changelog to ensure the fix is included. For source builds, pull from the official repository and verify the commit hash against the security advisory.

Detection guidance

Monitor for Vim crashes correlated with spell-checking activity, particularly when processing documents with unusually long words or after spell file modifications. Log spell-checking errors or warnings. Check running Vim processes and confirm they are running version 9.2.0698 or later using 'vim --version'. Audit spell file directories for unexpected or modified .spl files, which may indicate an attempt to deliver a malicious spell file.

Why prioritize this

With a CVSS 3.1 score of 7.8 (HIGH) reflecting high impact on confidentiality, integrity, and availability, this vulnerability merits prompt patching. Although not currently in the KEV catalog and requiring local access, the combination of stack corruption, user-facing denial of service, and the ubiquity of Vim in development and system administration roles justifies elevated priority. Organizations should patch within standard maintenance windows.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a local attack vector (AV:L), low attack complexity (AC:L), no privilege requirement (PR:N), and user interaction requirement (UI:R). The impact ratings—high for confidentiality, integrity, and availability (C:H/I:H/A:H)—reflect the severity of stack corruption and process crash. The score appropriately captures the risk of denial of service and potential (though difficult) privilege escalation via stack corruption.

Frequently asked questions