# [vim-security]: Heap Buffer Overflow with Crafted Spell File in Vim < 9.2.1309

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/580) · 2026-11-08 · Security
Page: https://themorning.dev/story/vim-security-heap-buffer-overflow-with-crafted-spell-file-in-vim-9-2-1309-b41d3eddcc2bd8e4
Kind: security · Impact: low

## In brief

- A heap buffer overflow in Vim can be triggered by a crafted spell file.
- The issue affects Vim versions before 9.2.1309.
- The advisory rates severity as Low, and no CVE has been assigned yet (requested only).

## Why it matters

Developers and sysadmins who run Vim older than 9.2.1309 should update, since opening a crafted spell file can corrupt memory.

## What to do

- Upgrade Vim to version 9.2.1309 or later

## Versions

- Vim 9.2.1309

## Timeline

- 2026-11-08: Heap buffer overflow with crafted spell file disclosed by Christian Brabandt on oss-security

## Coverage

- [[vim-security]: Heap Buffer Overflow with Crafted Spell File in Vim < 9.2.1309](https://seclists.org/oss-sec/2026/q4/580) — Open Source Security, 2026-11-08

Tags: vim, security, buffer-overflow, heap-overflow, spell-file

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev