CVE-2026-73072: Vim: Heap Buffer Overflow when Loading a Spell File
Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo() in src/spellfile.c reuses slsalfirst[] without resetting values left by setsalfirst(), so a crafted spell file containing an SNSAL section before an SNSOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.
Other sources
Vim: Heap Buffer Overflow when Loading a Spell File
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0957-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0846
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73072?
CVE-2026-73072 has a risk rating of 55, indicating a moderate security vulnerability.
How do I fix CVE-2026-73072?
To resolve CVE-2026-73072, update Vim to version 9.2.0846 or later.
What type of vulnerability is CVE-2026-73072?
CVE-2026-73072 is classified as a heap buffer overflow vulnerability.
What should I be aware of when using Vim prior to version 9.2.0846 with respect to CVE-2026-73072?
Using Vim versions prior to 9.2.0846 exposes users to potential exploits via crafted spell files.
Who is affected by CVE-2026-73072?
Users of Vim versions prior to 9.2.0846 are affected by the CVE-2026-73072 vulnerability.