Heap Overflow Vulnerability in Vim Command Line Text Editor
CVE-2026-73072

8.5HIGH

Key Information:

Vendor

Vim

Status
Vim
Vendor
CVE Published:
11 August 2026

What is CVE-2026-73072?

Vim, a widely used open-source command line text editor, is susceptible to a heap overflow vulnerability due to improper handling of certain spell file sections. Specifically, prior to version 9.2.0846, the function set_sofo() failed to reset values in sl_sal_first[], which can lead to under-counted mapping lists. An attacker could craft a malicious spell file containing an SN_SAL section followed by an SN_SOFO section, resulting in potential unauthorized writes beyond the heap allocation. This serious flaw has been addressed in the latest release, ensuring improved security and stability.

Affected Version(s)

vim < 9.2.0846

References

https://github.com/vim/vim/security/advisories/GHSA-9jqx-...
x_refsource_CONFIRM
https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f...
x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0846
x_refsource_MISC

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.