CVE-2026-45130 Details
Description
Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.
A heap buffer overflow vulnerability has been identified in Vim versions prior to 9.2.0450. The issue arises in the 'read_compound()' function within 'src/spellfile.c', when a crafted spell file (.spl) is loaded with UTF-8 encoding enabled. The vulnerability is triggered by an attacker-controlled length field in the spell file's compound section, which overflows a 32-bit signed integer multiplication. This overflow causes a small buffer to be allocated for a write loop that iterates many times, leading to a heap overflow. The vulnerability can be exploited if a malicious .spl file is placed on the runtime path and the 'spelllang' option is set from a modeline, prompting Vim to load the file.
Users can upgrade to Vim version 9.2.0450 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/14/3 | CVE | Mailing ListThird Party Advisory |
| https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8 | [email protected] | Patch |
| https://github.com/vim/vim/releases/tag/v9.2.0450 | [email protected] | Product |
| https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| neovim neovim | <= 0.12.2 |
CPE
Remediation
| |
| vim vim | < 9.2.0450 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | Reanalysis | [email protected] |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | CVE Modified | CVE |
| May 8, 2026 | New CVE Received | [email protected] |