Vim contains a heap buffer overflow in the function that reads a spell file when UTF‑8 is enabled. A crafted spell file contains a length field that overflows a signed 32‑bit multiplication, causing an excessively small buffer allocation. The subsequent write loop overruns this buffer and corrupts heap memory. Failure to contain the corruption could give an attacker the ability to run arbitrary code, although the CVE does not document confirmed exploitation. The bug is limited to the spell file loading routine, so it does not grant direct arbitrary code execution for the editor itself, but the corrupted heap can lead to crashes or exploit attempts by a savvy attacker.

All installations of the Vim editor built from the source tree whose version is older than 9.2.0450 are affected. The vulnerability resides in the vim:vim product and can be triggered on any platform where Vim runs with spell support enabled.

The security rating is a CVSS score of 6.6, indicating a moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely to be local or require the attacker to supply a malicious spell file; a modeline in a text file can set the spell language option and force Vim to load an embedded malicious compiled spell file from the runtime path. If an attacker can persuade a user to open such a file, the overflow may lead to heap corruption and potentially arbitrary code execution. No public exploitation has been reported, but the potential for memory corruption warrants prompt remediation.