CVE-2026-55693: Vim: Out-of-bounds Write in Spell File Word Count
Last updated 2 July 2026
Other sources
Vim is an open source, command line text editor. Prior to 9.2.0653, the treecountwords() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.
— MITRE
Vim: Out-of-bounds Write in Spell File Word Count
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0735-1 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0653
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55693?
CVE-2026-55693 has a medium severity rating of 5.7.
How do I fix CVE-2026-55693?
To fix CVE-2026-55693, update Vim to version 9.2.0653 or later.
What type of vulnerability is CVE-2026-55693?
CVE-2026-55693 is an out-of-bounds write vulnerability in Vim's spell file word count handling.
What impact does CVE-2026-55693 have on Vim users?
CVE-2026-55693 could potentially allow an attacker to exploit the out-of-bounds write, leading to unauthorized access or execution of arbitrary code.
Who is affected by CVE-2026-55693?
Any user of Vim versions prior to 9.2.0653 may be affected by CVE-2026-55693.