Stack Out-of-Bounds Write in Vim Text Editor

CVE-2026-57455

What is CVE-2026-57455?

A vulnerability in Vim, an open-source command line text editor, allows for a stack out-of-bounds write under specific conditions. The issue arises in the spell_soundfold_sofo() function where, prior to version 9.2.0698, the output index advances without proper bounds, leading to potential corruption of the call frame. This can occur when longer words are processed while a SOFO-based spell language is active, resulting in the writing past the allocated buffer and ultimately crashing the editor. Users should upgrade to version 9.2.0698 to mitigate this risk.

References