Vim: Heap Buffer Overflow when Loading a Spell File
Published Aug 11, 2026
8.5
HIGHCVSS 4.0
EPSS 0.13%
Description
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.
Affected products
-
- Version < 9.2.0846StatusaffectedConstraints-
- Version
No data.
Red Hat Enterprise Linux 10
vim-2:9.1.083-9.el10_2.20
Fixed · RHSA-2026:66336
Red Hat Enterprise Linux 7 Extended Lifecycle Support
vim-2:7.4.629-8.el7_9.2
Fixed · RHSA-2026:68711
Red Hat Enterprise Linux 8
vim-2:8.0.1763-31.el8_10.7
Fixed · RHSA-2026:66348
Red Hat Enterprise Linux 8
vim-2:8.0.1763-31.el8_10.7
Fixed · RHSA-2026:66348
Red Hat Enterprise Linux 9
vim-2:8.2.2637-26.el9_8.21
Fixed · RHSA-2026:66366
Red Hat Enterprise Linux 9
vim-2:8.2.2637-26.el9_8.21
Fixed · RHSA-2026:66366
Red Hat Update Infrastructure 5
rhui5/cds-kubernetes-rhel9:1789479916
Fixed · RHSA-2026:67956
Red Hat Update Infrastructure 5
rhui5/cds-rhel9:1789479900
Fixed · RHSA-2026:67956
Red Hat Update Infrastructure 5
rhui5/haproxy-rhel9:1789479891
Fixed · RHSA-2026:67956
Red Hat Update Infrastructure 5
rhui5/installer-rhel9:1789482961
Fixed · RHSA-2026:67956
Red Hat Enterprise Linux 6
vim
Affected
Red Hat Hardened Images
vim
Not affected
Red Hat OpenShift Container Platform 4
openshift/ose-rhel-coreos-8
Not affected
Red Hat OpenShift Container Platform 4
openshift/ose-rhel-coreos-9
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | vim-2:9.1.083-9.el10_2.20 | Fixed | RHSA-2026:66336 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | vim-2:7.4.629-8.el7_9.2 | Fixed | RHSA-2026:68711 |
| Red Hat Enterprise Linux 8 | vim-2:8.0.1763-31.el8_10.7 | Fixed | RHSA-2026:66348 |
| Red Hat Enterprise Linux 8 | vim-2:8.0.1763-31.el8_10.7 | Fixed | RHSA-2026:66348 |
| Red Hat Enterprise Linux 9 | vim-2:8.2.2637-26.el9_8.21 | Fixed | RHSA-2026:66366 |
| Red Hat Enterprise Linux 9 | vim-2:8.2.2637-26.el9_8.21 | Fixed | RHSA-2026:66366 |
| Red Hat Update Infrastructure 5 | rhui5/cds-kubernetes-rhel9:1789479916 | Fixed | RHSA-2026:67956 |
| Red Hat Update Infrastructure 5 | rhui5/cds-rhel9:1789479900 | Fixed | RHSA-2026:67956 |
| Red Hat Update Infrastructure 5 | rhui5/haproxy-rhel9:1789479891 | Fixed | RHSA-2026:67956 |
| Red Hat Update Infrastructure 5 | rhui5/installer-rhel9:1789482961 | Fixed | RHSA-2026:67956 |
| Red Hat Enterprise Linux 6 | vim | Affected | n/a |
| Red Hat Hardened Images | vim | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
A local attacker can exploit an Important heap buffer overflow in Vim to execute arbitrary code by tricking a user into loading a malicious spell file.
Red Hat mitigation
If spell checking is unused, disable it with set nospell in ~/.vimrc and do not set spelllang. If spell is required, load only trusted .spl files from Vim’s spell directories and do not place untrusted spell files on runtimepath. Additionally, consider disabling modelines (set nomodeline in ~/.vimrc) to prevent untrusted text files from automatically overriding these settings when opened.
References (8)
- https://access.redhat.com/security/cve/CVE-2026-73072 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2514037 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56226 Advisory
- https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a x_refsource_MISC
- https://github.com/vim/vim/releases/tag/v9.2.0846 x_refsource_MISC
- https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64 x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-73072
- https://www.cve.org/CVERecord?id=CVE-2026-73072
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-73072 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2514037 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56226 | Advisory | |
| https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a | x_refsource_MISC | |
| https://github.com/vim/vim/releases/tag/v9.2.0846 | x_refsource_MISC | |
| https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64 | x_refsource_CONFIRM | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-73072 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-73072 |
Change history (0)
No recorded changes yet.