CVE-2026-59857

Vim: Out-of-bounds Write in SAL Soundfolding

Published Jul 9, 2026 CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Description

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.

Analysis

Technical impact

The flaw occurs in Vim’s spell sound‑folding logic. In the single‑byte branch of spell_soundfold_sal(), a malformed boundary‑length word written to a fixed‑size stack buffer can overwrite memory beyond the buffer, triggering a crash. This is a classic stack buffer overflow (CWE‑787) and is limited to a denial of service; it does not provide code execution or data tampering.

Affected Systems

All installations of Vim older than revision 9.2.0725 are vulnerable whenibyte 8‑bit encoding. Users who enable spell checking with custom SAL spell files or load spell suggestions that exercise the vulnerable path are at risk.

Risk and Exploitability

The CVSS score of 5.6 indicates moderate severity. The EPSS score is reported as below 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low probability of active exploitation. Based on the description, the likely attack vector is local – an attacker would need to supply a crafted file or word to trigger the sound‑ to invoke spell‑suggestion functionality that processes a boundary‑length word.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

vim

affected

Version	Status	Constraints
`< 9.2.0725`	affected	—

Configuration 1 [-]

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Vim

Version	Status	Scheme	Platform
`[0,9.2.0725)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Vim to version 9.2.0725 or later to apply the official fix.
If an immediate upgrade is not possible, temporarily disable spell checking (e.g., turn off the 'spell' option) or change the encoding to a multibyte format such as UTF‑8 to avoid executing the vulnerable single‑byte path.
For environments that require spell support, remove or replace any custom spell files containing SAL sound‑folding rules, or avoid selecting SAL‑based languages when using 8‑bit locales.

Generated by OpenCVE AI on August 1, 2026 at 13:34 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8541-1	Vim vulnerabilities

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.110% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30
https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2
https://nvd.nist.gov/vuln/detail/CVE-2026-59857
https://www.cve.org/CVERecord?id=CVE-2026-59857

History

Jul 13, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-59857 https://www.cve.org/CVERecord?id=CVE-2026-59857
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jul 10, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 9, 2026 11:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vim Vim vim
Vendors & Products		Vim Vim vim

Jul 9, 2026 10:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.
Title		Vim: Out-of-bounds Write in SAL Soundfolding
Weaknesses		CWE-787
References		https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30 https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2
Metrics		cvssV4_0 `{'score': 5.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`