CVE-2026-55892: Vim: Out-of-bounds Write in Spell File Prefix Dump
Last updated 2 July 2026
Other sources
Vim is an open source, command line text editor. Prior to 9.2.0662, the dumpprefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.
— NVD
Vim: Out-of-bounds Write in Spell File Prefix Dump
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0735-1 - Upgrade
Upgrade
vimto a version that resolves this vulnerability.Fixed in 9.2.0662
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55892?
CVE-2026-55892 has a medium severity rating of 5.5.
How do I fix CVE-2026-55892?
To mitigate CVE-2026-55892, update Vim to version 9.2.0662 or later.
What is CVE-2026-55892 about?
CVE-2026-55892 details an out-of-bounds write vulnerability in the dump_prefixes() function of Vim's spell.c module.
Which versions of Vim are affected by CVE-2026-55892?
Versions of Vim prior to 9.2.0662 are affected by CVE-2026-55892.
What are the potential consequences of CVE-2026-55892?
Exploitation of CVE-2026-55892 could lead to a denial of service due to memory corruption.