Vim’s spell_soundfold_sofo() function copies characters from a spell file’s SOFO map into a caller‑supplied buffer without checking the buffer length. When a word longer than the 4‑byte MAXWLEN limit is processed, the function writes past the end of the stack buffer, corrupting the call frame and causing the editor to crash. The vulnerability is a classic stack buffer overflow (CWE‑787) and results in a denial of service but not a code execution flaw.

The flaw affects all Vim installations running a version prior to 9.2.0698. The official fix is included in Vim release 9.2.0698 and all later versions. Systems using older releases are affected regardless of platform or configuration.

With a CVSS score of 4 the vulnerability is considered medium severity. The exploit requires local access to the Vim process and sufficient input to trigger the overflow; no known network‑based attack vector is documented. EPSS data is unavailable, and the issue is not listed in CISA’s KEV catalog, indicating limited known exploitation. The risk therefore remains moderate, with the primary consequence being application instability and potential denial of service for users.