CVE-2026-45130
MEDIUM EPSS 16.0%
Published May 8, 20261mo ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Published May 8, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago
Description
Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
16.0% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available
Weaknesses 2
CWE-122
CWE-190 Integer Overflow or Wraparound Numeric Error
Affected Products 2
References 4
- openwall.com http://www.openwall.com/lists/oss-security/2026/05/14/3
- github.com https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8
- github.com https://github.com/vim/vim/releases/tag/v9.2.0450
- github.com https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv
Remediation
- github.com https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8
- github.com https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv