Vim CVE-2026-57455

Exploitation requires all of the following local conditions simultaneously: Vim must be running on the local system (AV:L - no network vector exists), spell checking must be active (set spell), a SOFO-based spell language file must be loaded via set spelllang pointing to a dictionary that uses SOFOFROM/SOFOTO directives, and the user must actively trigger a soundfold operation - either via Vim's soundfold() function or via sound-based spell suggestion (z=) - on a word exceeding MAXWLEN (254) bytes. The UI:A metric confirms active user interaction is mandatory. Exploitation is further limited by AC:H: the non-default SOFO spell file must be present and loaded, a condition uncommon in standard Vim deployments. Vim instances compiled without spell-check support, deployments where spell checking is never enabled, and deployments using only non-SOFO spell files are not affected.

The CVSS 4.0 base score of 4.0 (Medium) accurately reflects the constrained exploitation environment: AV:L restricts the attack to local access, AC:H demands a specific SOFO spell-file configuration, and UI:A requires active user interaction to trigger the soundfold path. Despite the impact metrics being uniformly high (VC:H/VI:H/VA:H), reflecting the theoretical severity of a stack smash, the combination of non-network attack vector and high complexity significantly limits real-world risk. No EPSS score is available in the provided data, so exploitation probability cannot be quantified probabilistically; however, E:U in the CVSS 4.0 vector confirms no exploit maturity at time of publication. KEV status is not confirmed, indicating no observed active exploitation. The primary realistic risk is crash-as-denial-of-service for affected users loading SOFO spell files; controlled code execution would require advanced exploitation skill and a very specific environment. This is not an emergency-response priority - patch on the next maintenance cycle is appropriate for most organizations.

An attacker crafts a malicious SOFO-based spell file containing SOFOFROM/SOFOTO entries and social-engineers a local user into loading it in Vim with spell checking enabled. When the victim invokes a sound-based spell suggestion (e.g., z=) on a word longer than 254 bytes - or when the soundfold() function is triggered programmatically - the unguarded copy loop in spell_soundfold_sofo() writes past the MAXWLEN stack buffer, corrupting the call frame and crashing Vim. No public proof-of-concept exists, and developing the crash into controlled code execution would require additional exploitation sophistication targeting the specific stack layout.