Vim CVE-2026-45130

Two simultaneous preconditions are required. First, a malicious .spl file must already be present in a directory on Vim's runtimepath (e.g., ~/.vim/spell/ or a path listed in &runtimepath) - the attacker must have pre-planted this file through write access, a shared filesystem, or social engineering. Second, the victim must open a file in Vim that contains a modeline setting spelllang to trigger loading of the planted .spl, with UTF-8 encoding active and Vim's modeline feature not disabled. No system authentication or elevated privileges are required of the attacker (PR:N). Exploitation is bounded by: the necessity of pre-planting the .spl on the runtimepath (requires attacker write access to that path or user cooperation), the requirement for active user interaction (opening the text file in Vim), the absence of any network delivery path (AV:L), and the fact that SSVC rates this as not automatable - consistent with a multi-step, per-victim attack that cannot be mass-deployed without runtimepath access.

The CVSS 3.1 score of 6.6 (Medium) is grounded in AV:L (local file-based delivery), UI:R (victim must open a file), C:L/I:L (partial memory disclosure and write capability), and A:H (heap corruption can crash or destabilize the process). The vendor-assigned PR:N is accurate in that the attacker does not need system credentials, but it somewhat understates the setup burden: a malicious .spl file must be pre-positioned on the Vim runtimepath before the modeline triggers loading. EPSS at 0.00% (0th percentile) and SSVC's 'exploitation: none, automatable: no, technical impact: partial' collectively indicate no observed opportunistic or automated exploitation. However, a public PoC exists (GitHub Gist by zhuozhenwei, confirmed in references), which elevates near-term risk - particularly for users who open files from untrusted sources in shared or version-controlled environments where runtimepath directories may be attacker-writable. The gap between the public PoC and the 0.00% EPSS is consistent with a proof-of-concept that has not yet been operationalized in mass campaigns. Overall this is a real but conditional threat: prioritize patching for environments with shared Vim runtimepaths, CI pipelines that open arbitrary files, or users who regularly process untrusted documents.

An attacker with write access to a shared Vim runtimepath directory (e.g., a team's shared ~/.vim/ checkout or a CI workspace) plants a crafted .spl file containing an oversized COMPOUND section length field. The attacker then delivers a text file embedding a Vim modeline such as `

vim: set spelllang=xx:` referencing the malicious spell file; when a developer opens this file in a Vim version prior to 9.2.0450 with default modeline settings and UTF-8 encoding active, read_compound() triggers, the integer multiplication overflows, and the heap write loop corrupts adjacent allocations - potentially crashing Vim or enabling controlled code execution. A public PoC demonstrating this is available at https://gist.github.com/zhuozhenwei/9e579b64c83fd2d254e25f1629da2796.