REDHAT-BUG-2514037: High severity vim Vim vulnerability

Q: What must an attacker provide to trigger the flaw?

An attacker must cause Vim to process a crafted spell file that places an SN_SAL section before an SN_SOFO section. The malformed section ordering leads to an under-counted mapping list and writes beyond a heap allocation.

Q: Which Vim versions are affected?

The issue affects Vim versions prior to 9.2.0846. It is fixed in Vim 9.2.0846.

Published Aug 11, 2026

Updated

Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo() in src/spellfile.c reuses slsalfirst[] without resetting values left by setsalfirst(), so a crafted spell file containing an SNSAL section before an SNSOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.

Affected Software

1 affected component

vim Vim<9.2.0846

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade vim to a version that resolves this vulnerability.
Fixed in 9.2.0846

Event History

Aug 11, 2026

Data Sourced

via Red Hat·03:41 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker provide to trigger the flaw?

An attacker must cause Vim to process a crafted spell file that places an SN_SAL section before an SN_SOFO section. The malformed section ordering leads to an under-counted mapping list and writes beyond a heap allocation.

Which Vim versions are affected?

The issue affects Vim versions prior to 9.2.0846. It is fixed in Vim 9.2.0846.

REDHAT-BUG-2514037: High severity vim Vim vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker provide to trigger the flaw?

Which Vim versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the flaw?

Which Vim versions are affected?