Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-09T22:34:54 vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-787

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.

An out-of-bounds write vulnerability in Vim's spell_soundfold_sal() function allows an attacker to corrupt memory and crash the editor (Denial of Service) by supplying a specially crafted word during spell sound-folding.

This Moderate impact flaw in Vim's spell sound-folding feature can lead to a denial of service. A local attacker could provide a specially crafted word, causing an out-of-bounds write and crashing the editor. This vulnerability primarily affects interactive users of the Vim text editor. This vulnerability can be mitigated by preventing Vim from automatically applying editor configurations embedded in files. Add the following line to the global /etc/vimrc or local ~/.vimrc configuration file: set nomodeline Red Hat Hardened Images 2026-07-03T00:00:00Z RHSA-2026:35387 vim-main-9.2.780-1.hum1 Red Hat Enterprise Linux 10 Affected vim Red Hat Enterprise Linux 6 Out of support scope vim Red Hat Enterprise Linux 7 Out of support scope vim Red Hat Enterprise Linux 8 Fix deferred vim Red Hat Enterprise Linux 9 Affected vim Red Hat OpenShift Container Platform 4 Fix deferred rhcos https://www.cve.org/CVERecord?id=CVE-2026-59857 https://nvd.nist.gov/vuln/detail/CVE-2026-59857 https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30 https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2