CVE-2026-55892 Details
Description
Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.
A stack out-of-bounds write vulnerability has been identified in Vim versions prior to 9.2.0662. The issue arises in the 'dump_prefixes()' function within 'src/spell.c', where the function processes a spell-file prefix trie. The depth counter, which guides the traversal, is only limited by the trie structure and not by the size of the fixed MAXWLEN-element stack arrays it references. This flaw allows a specially crafted .spl file to be loaded, driving the traversal deeper than safe limits, causing the function to write past the end of the arrays. This out-of-bounds write corrupts the call frame, leading to a crash of the editor.
Users can upgrade to Vim version 9.2.0662 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vim vim | < 9.2.0662 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | New CVE Received | [email protected] |