CVE-2026-45130
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Vim prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath.
Risk Assessment
An attacker can remotely execute arbitrary code in the context of the user opening a crafted text file in Vim, leading to full system compromise.
Recommendation
Update Vim to version 9.2.0450 or later, which includes a fix preventing heap overflow during spell file loading.
Other vulnerabilities in Vim
See all- CVE-2026-73073High
Vim prior to 9.2.0845 has a vulnerability in StructMembers() in runtime/autoload/ccomplete.vim, which constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.
- CVE-2026-73078High
Vim, an open source command line text editor, prior to 9.2.0840 has a vulnerability in runtime/plugin/netrwPlugin.vim and runtime/pack/dist/opt/netrw/autoload/netrw.vim where Bookmarks, History, and Targets menu entries are constructed by interpolating attacker-controlled directory paths into executed :menu commands. Functions s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. The issue is fixed in version 9.2.0840.
- CVE-2026-73076High
In Vim before 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including OS commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
- CVE-2026-73071Low
Vim, an open source text editor, has a vulnerability in json_decode_item() in src/json.c that can retain a stale pointer after json_decode_string() invokes channel_fill(), causing the error path to read freed memory when an invalid JSON string spans buffers. Affects versions from 9.2.0511 to 9.2.0844, fixed in 9.2.0844.
- CVE-2026-73070Medium
Vim, an open source command line text editor, prior to version 9.2.0842 has a vulnerability in the socket server backend in src/socketserver.c that accepts unbounded client connections, causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c. A local process that can connect to the server socket can corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.
- CVE-2017-11109High
Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file.
- CVE-2016-1248High
Vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax', and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
- CVE-2024-43802Medium
Vim is an improved version of the Unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. This may lead to the tb_off position within the buffer being out of bounds.
- CVE-2024-47814Low
In Vim before 9.1.0764, a use-after-free occurs when closing a buffer and a BufWinLeave auto command reopens the same buffer in a new split window.
- CVE-2026-34714Critical
A vulnerability in Vim before version 9.2.0272 allows immediate code execution upon opening a crafted file in the default configuration. The issue is due to %{expr} injection in tabpanel lacking the P_MLE flag.
Original NVD description (English source)
Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.