[vim-security]: Heap Buffer Overflow with Crafted Spell File in Vim < 9.2.1309

The Brief

A heap buffer overflow in Vim can be triggered by a crafted spell file.
The issue affects Vim versions before 9.2.1309.
The advisory rates severity as Low, and no CVE has been assigned yet (requested only).

Why it matters

Developers and sysadmins who run Vim older than 9.2.1309 should update, since opening a crafted spell file can corrupt memory.

Who’s affected

Vim users running versions before 9.2.1309

What to do

Upgrade Vim to version 9.2.1309 or later

Vim 9.2.1309
#vim
#security
#buffer-overflow
#heap-overflow
#spell-file

Posted by Christian Brabandt on Nov 08 Heap Buffer Overflow with Crafted Spell File in Vim < 9.2.1309 ============================================================== Date: 08.11.2026 Severity: Low CVE: *requested, not yet assigned* CWE: Access of Resource Using Incompatible Type…

Read the full story at seclists.org ↗

Timeline

Nov 8
Heap buffer overflow with crafted spell file disclosed by Christian Brabandt on oss-security
Nov 8 · 11:46 PM
Open Source Security
[vim-security]: Heap Buffer Overflow with Crafted Spell File in Vim < 9.2.1309