Description
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.
Published: 2026-08-11
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A malformed spell file that begins with an SN_SAL section followed by an SN_SOFO section triggers a reuse of the sl_sal_first[] array without resetting values set by set_sal_first(). This causes under‑counted mapping lists and allows attacker‑influenced writes beyond the bounds of a heap allocation. The result is a heap buffer overflow that corrupts memory. The specific higher‑level consequences of that corruption, such as code execution or denial of service, are not described in the CVE details.

Affected Systems

Vim prior to version 9.2.0846 is vulnerable. This includes all releases before 9.2.0846 available for Linux, Windows, macOS, and other platforms that install Vim from source or package managers.

Risk and Exploitability

The CVSS score of 8.5 classifies this flaw as High severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is triggered by loading a spell file, a user‑controlled input. The exact attack vector (local or remote) and the conditions needed for successful exploitation are not specified in the advisory. The vulnerability could lead to memory corruption; further impacts depend on the environment and are not detailed.

Generated by OpenCVE AI on August 11, 2026 at 23:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Vim to version 9.2.0846 or later, which includes the fixed set_sofo implementation
  • Disallow or restrict loading of custom spell files in environments that cannot be trusted until a patch is applied
  • Audit current Vim installations for the presence of the old set_sofo code path and verify that the upgrade has replaced it

Generated by OpenCVE AI on August 11, 2026 at 23:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 11 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Vim
Vim vim
Vendors & Products Vim
Vim vim

Tue, 11 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Description Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.
Title Vim: Heap Buffer Overflow when Loading a Spell File
Weaknesses CWE-122
CWE-787
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Vim Vim
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-13T15:17:50.587Z

Reserved: 2026-08-10T19:37:41.444Z

Link: CVE-2026-73072

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-11T16:17:38.553

Modified: 2026-08-13T16:19:03.257

Link: CVE-2026-73072

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-11T15:31:35Z

Links: CVE-2026-73072 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T23:30:06Z

Weaknesses