Skip to main content

Vim CVE-2026-45130

MEDIUM
Heap-based Buffer Overflow (CWE-122)
2026-05-08 GitHub_M
Buffer Overflow Heap Overflow Vim
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.8 MEDIUM

Pre-planting the malicious .spl on the victim's runtimepath is a measurable attack prerequisite beyond initial access, warranting AC:H over the vendor's AC:L.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.6 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Red Hat
6.6 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 24, 2026 - 20:22 NVD
6.6 (MEDIUM) 5.5 (MEDIUM)
Source Code Evidence Fetched
Jul 24, 2026 - 00:20 vuln.today
Analysis Generated
Jul 24, 2026 - 00:20 vuln.today
CVE Published
May 08, 2026 - 22:42 nvd
MEDIUM 6.6

DescriptionNVD

Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.

AnalysisAI

Heap buffer overflow in Vim's spell file parser affects all versions prior to 9.2.0450, reachable via a crafted .spl file that exploits a 32-bit signed integer multiplication overflow in read_compound() to allocate an undersized heap buffer and overflow it during a write loop. The attack can be delivered passively through Vim's modeline feature: a text file with a spelllang modeline silently triggers .spl loading when a malicious spell file has been pre-planted on the runtimepath, requiring only that the victim open the file. A public proof-of-concept exists on GitHub Gist; EPSS is 0.00% and CISA KEV has not listed this CVE, indicating no confirmed widespread exploitation at time of analysis.

Technical ContextAI

The vulnerable component is read_compound() in src/spellfile.c, which parses the COMPOUND section of Vim's binary .spl (spell language) files. The root cause (CWE-122, Heap-based Buffer Overflow) is a 32-bit signed integer multiplication overflow: the attacker-controlled todo field from the spell file's section header is multiplied as a signed 32-bit integer when computing heap allocation sizes (e.g., c = todo * 2 + 7). A sufficiently large todo value wraps the product to a small positive number, causing alloc() to return a tiny buffer while the subsequent write loop iterates todo times - far beyond the buffer's bounds. The fix in commit 92993329 introduces a COMPOUND_MAX_LEN constant (100,000), promotes all size calculations to size_t to eliminate overflow, and validates the length before allocation. The attack surface is widened by Vim's modeline mechanism: with modeline enabled (the default in most distributions), a file's embedded set spelllang=XX directive can auto-load a .spl file from the runtimepath without further user interaction. CPE: cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* (all versions prior to 9.2.0450).

RemediationAI

Upgrade Vim to version 9.2.0450 or later; the patched release is available at https://github.com/vim/vim/releases/tag/v9.2.0450 and the fixing commit is 92993329178cb1f72d700fff45ca86e1c2d369f8. Ubuntu users should apply the update referenced in USN-8304-1 (https://ubuntu.com/security/notices/USN-8304-1) via their package manager. If immediate patching is not possible, add set nomodeline to the system or user vimrc (/etc/vim/vimrc or ~/.vimrc) to prevent modeline-triggered spell file loading; the trade-off is loss of legitimate per-file editor configuration embedded in modelines. As a complementary control, restrict write access to Vim runtimepath spell directories (typically ~/.vim/spell/ and /usr/share/vim/vimXX/spell/) to prevent attacker-controlled .spl file planting - this eliminates the automated delivery path but does not block a user who is socially engineered into manually loading a crafted spell file.

More in Vim

View all
CVE-2022-3520 CRITICAL POC
9.8 Dec 02

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Rated critical severity (CVSS 9.8), this vuln
CVE-2022-0729 HIGH POC
8.8 Feb 23

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this

CVE-2026-34714 HIGH POC
8.6 Mar 30

Code execution vulnerability in Vim before 9.2.0272 allows attackers to gain immediate arbitrary command execution upon

CVE-2019-12735 HIGH POC
8.6 Jun 05

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
CVE-2021-3968 HIGH POC
8.0 Nov 19

vim is vulnerable to Heap-based Buffer Overflow. Rated high severity (CVSS 8.0), this vulnerability is remotely exploita
CVE-2023-4735 HIGH POC
7.8 Sep 02

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. Rated high severity (CVSS 7.8), this vulnerability i
CVE-2023-4781 HIGH POC
7.8 Sep 05

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. Rated high severity (CVSS 7.8), this vulnerab
CVE-2023-4734 HIGH POC
7.8 Sep 02

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. Rated high severity (CVSS 7.8), this vuln
CVE-2023-4733 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1840. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4750 HIGH POC
7.8 Sep 04

Use After Free in GitHub repository vim/vim prior to 9.0.1857. Rated high severity (CVSS 7.8), this vulnerability is no

CVE-2023-4736 HIGH POC
7.8 Sep 02

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-2610 HIGH POC
7.8 May 09

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. Rated high severity (CVSS 7.8), this vuln

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

CVE-2026-45130 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy