The flaw occurs in Vim’s spell sound‑folding logic. In the single‑byte branch of spell_soundfold_sal(), a malformed boundary‑length word written to a fixed‑size stack buffer can overwrite memory beyond the buffer, triggering a crash. This is a classic stack buffer overflow (CWE‑787) and is limited to a denial of service; it does not provide code execution or data tampering.

All installations of Vim older than revision 9.2.0725 are vulnerable whenibyte 8‑bit encoding. Users who enable spell checking with custom SAL spell files or load spell suggestions that exercise the vulnerable path are at risk.

The CVSS score of 5.6 indicates moderate severity. The EPSS score is reported as below 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low probability of active exploitation. Based on the description, the likely attack vector is local – an attacker would need to supply a crafted file or word to trigger the sound‑ to invoke spell‑suggestion functionality that processes a boundary‑length word.