CVE-2026-45130

MEDIUM EPSS 16.0%
Published May 8, 20261mo ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published May 8, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago

Description

Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
16.0% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-122
CWE-190 Integer Overflow or Wraparound Numeric Error

Affected Products 2

VendorProductVersionRange
neovimneovim* ≤0.12.2
vimvim* <9.2.0450

References 4

  • openwall.com http://www.openwall.com/lists/oss-security/2026/05/14/3
    Mailing ListThird Party Advisory
  • github.com https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8
    Patch
  • github.com https://github.com/vim/vim/releases/tag/v9.2.0450
    Product
  • github.com https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv
    ExploitPatchVendor Advisory

Remediation

  • github.com https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8
    Patch
  • github.com https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv
    ExploitPatchVendor Advisory