CVE-2026-59857 Details
Description
Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.
A stack-based out-of-bounds write vulnerability has been identified in Vim's sound-folding spell feature, specifically in versions prior to 9.2.0725. The issue arises in the single-byte branch of the 'spell_soundfold_sal()' function within 'src/spell.c'. Here, the function translates words according to a spell file's SAL sound-folding rules, writing the results into a caller-owned buffer. The writes are supposed to be limited by the buffer length, but a flaw allows the buffer to be overrun. This vulnerability can be exploited by crafting a spell file that takes advantage of the SAL rules, leading to a buffer overflow that corrupts the stack frame and causes the editor to crash.
Users can upgrade to Vim version 9.2.0725 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30 | [email protected] | Patch |
| https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vim vim | < 9.2.0725 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | Initial Analysis | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |