Vim CVE-2026-59857

Three simultaneous conditions are required: (1) a SAL-based spell file must be loaded and active in Vim - SAL is a specific sound-folding mechanism in spell files, not all spell files use it, making this a non-default configuration; (2) Vim's encoding must be set to a non-multibyte 8-bit encoding such as latin1 or similar, not UTF-8, which is increasingly the default; (3) a word of exactly MAXWLEN characters must be passed to soundfold(), either directly or via sound-based spell suggestion traversal. Active user interaction is required (UI:A per CVSS 4.0) - the user must trigger spell suggestions or open content that does so. These conditions jointly mean default UTF-8 Vim installations are not vulnerable. Exploitation is limited to crashing the editor process; privilege escalation or data exfiltration are not demonstrated impacts.

The CVSS 4.0 score of 5.6 (Medium) accurately reflects the constrained risk profile: AV:L confirms the attack is local to the editor process, AT:P acknowledges specific prerequisites that limit opportunistic exploitation, and VA:H correctly captures the crash impact. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. The impact is DoS only - confidentiality and integrity are explicitly unaffected (VC:N/VI:N). Stack corruption from an off-by-one null write is theoretically exploitable for code execution in highly controlled scenarios, but no published research or POC demonstrates this. The practical risk is therefore an editor crash triggered under a specific, non-default configuration. This is a low-priority remediation item for most organizations unless automated document processing pipelines invoke Vim with SAL spell files under 8-bit encodings - an uncommon but non-zero server-side use case.

A user opens Vim with a SAL-enabled spell file active (e.g., a language pack using phonetic sound-alike rules) while their encoding is set to a non-multibyte 8-bit value such as latin1, then either manually invokes spell suggestions on a word exactly at the MAXWLEN boundary or opens a crafted document that causes such a word to be processed automatically during spell checking. The off-by-one null write corrupts the eval_soundfold() stack frame, causing Vim to crash. No public proof-of-concept exploit has been identified.