Heap Overflow Vulnerability in Vim Command Line Text Editor
CVE-2026-73072
Key Information:
Badges
What is CVE-2026-73072?
Vim, a widely used open-source command line text editor, is susceptible to a heap overflow vulnerability due to improper handling of certain spell file sections. Specifically, prior to version 9.2.0846, the function set_sofo() failed to reset values in sl_sal_first[], which can lead to under-counted mapping lists. An attacker could craft a malicious spell file containing an SN_SAL section followed by an SN_SOFO section, resulting in potential unauthorized writes beyond the heap allocation. This serious flaw has been addressed in the latest release, ensuring improved security and stability.
Affected Version(s)
vim < 9.2.0846
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.