Vim EUVD-2026-39452

Exploitation requires all of the following conditions to be met simultaneously: (1) a crafted .spl/.sug file pair must be present in a directory on Vim's runtimepath - this is a local filesystem delivery requirement, not a remote network attack; (2) the user must have spell checking enabled (set spell) and must have configured the crafted spell language (set spelllang=<malicious-lang>); (3) the user must actively invoke spell suggestion, either via z= in normal mode or by calling spellsuggest() - merely having the file present or opening a file with spell enabled is insufficient without the suggestion invocation. Exploitation is limited by: the non-default nature of spell file loading from untrusted sources, the requirement for active user interaction to trigger the suggestion code path, and the local attack vector meaning the attacker cannot exploit this remotely over a network. Default Vim installations with no custom spell files loaded are not at risk.

The CVSS 4.0 score of 5.7 (Medium) reflects the realistic exploitation constraints: local attack vector (AV:L) and mandatory active user interaction (UI:A) substantially reduce exploitability despite the High impact across confidentiality, integrity, and availability on the vulnerable system. The E:U temporal modifier confirms no known public exploit code, and there is no CISA KEV listing indicating active exploitation. EPSS data was not supplied. The theoretical impact of uncontrolled stack corruption is severe - arbitrary code execution is plausible - but the confirmed outcome from the test case is an editor crash (denial of service). From an SSVC perspective: exploitation status = none/PoC-level (test case only), automatable = no (requires file delivery to victim's runtime path and deliberate user action), technical impact = partial (crash confirmed, reliable RCE not demonstrated). The gap between High C/I/A metrics and the Medium overall score is well-explained by the local vector and interaction requirement. This is a genuine priority for users who process untrusted .spl/.sug files but a low-urgency issue for typical interactive Vim users with no untrusted spell files in their runtime.

An attacker crafts a malicious .spl/.sug file pair containing a BY_INDEX self-referencing node in the fold-word trie that bypasses Vim's parse-time depth cap but drives tree_count_words() to an unbounded depth at runtime. The attacker plants the file pair in the victim's Vim spell directory - for example, via a shared dotfile repository, a compromised plugin manager, or a malicious workspace - and waits for the victim to open a file with spell checking enabled against the crafted language and invoke spell suggestions (via z= or spellsuggest()), at which point the stack out-of-bounds write crashes the editor and may corrupt adjacent stack frames. No independent public exploit code exists, but the upstream commit includes a working test case that reliably reproduces the out-of-bounds write.