Vim EUVD-2026-56226

Exploitation requires a victim running a vulnerable version of Vim (prior to 9.2.0846) to load a crafted spell file. The spell file must contain an SN_SAL section appearing before an SN_SOFO section, with the SOFO section specifying at least two multi-byte 'from' characters that share the same low byte value - this specific section ordering is what poisons sl_sal_first[] and triggers the under-count. No elevated privileges are required; a standard user account running Vim is sufficient. Exploitation is limited by the passive user interaction requirement: the victim must either explicitly set spelllang to point to the malicious file, open a file whose modeline or spell configuration triggers loading the crafted .spl, or have the file placed in a runtimepath directory that Vim searches automatically for spell data. Non-default spell file sources and the requirement to deliver a file to the victim's reachable filesystem are the primary limiting factors.

The CVSS 4.0 score of 8.5 (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) accurately reflects that while impact is severe - full confidentiality, integrity, and availability compromise of the vulnerable system - exploitation requires local file delivery and passive user interaction. Attack complexity is low once a crafted spell file is constructed, and no privileges are needed for the attacker. The vulnerability is not listed in the CISA KEV catalog, no EPSS data was provided in the source intelligence, and no public exploit code has been identified, all of which suggest this has not yet reached widespread active exploitation. However, the commit diff includes a precise binary regression test payload (the crafted spell file bytes), which substantially lowers the barrier for exploit development. Even a mid-sized municipal IT department in swidnica managing developer workstations or shared Linux servers should treat this as an actionable priority, particularly where Vim is used to process spell files originating from external or untrusted repositories. The CVSS vector is internally consistent with the description: local vector, user interaction, and high tripartite impact are all well-supported by the technical evidence.

An attacker crafts a malicious Vim spell file containing an SN_SAL section followed by an SN_SOFO section whose multi-byte 'from' entries share a low byte, designed to trigger the under-count condition and write controlled data beyond the heap allocation. The spell file is delivered to the target via a poisoned repository, documentation archive, or shared network drive, and the victim opens a file that causes Vim to load the crafted .spl (for example, by setting spelllang to a language pointing to the malicious file). The resulting heap corruption could overwrite adjacent heap metadata or a function pointer, enabling code execution under the victim's user context.