CVE-2026-73072 in Vim
Summary
by MITRE • 08/11/2026
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described affects the widely-used Vim text editor, specifically impacting versions prior to 9.2.0846 through a flaw in the spell file processing functionality. The issue stems from improper memory management within the set_sofo() function located in src/spellfile.c, which fails to properly reset values in the sl_sal_first[] array that were previously populated by set_sal_first(). This creates a scenario where crafted spell files can manipulate the internal state of the editor's spell checking system.
The technical exploitation occurs when a spell file contains an SN_SAL section followed by an SN_SOFO section, allowing attackers to manipulate how mapping lists are counted and processed. The vulnerability manifests as under-counted mapping lists combined with attacker-influenced writes that extend beyond allocated heap memory boundaries. This represents a classic buffer overread condition that can lead to memory corruption and potentially arbitrary code execution within the context of the running Vim process.
From a cybersecurity perspective, this vulnerability aligns with CWE-129, which addresses improper handling of length values and count variables, and CWE-787, concerning out-of-bounds writes. The attack surface is particularly concerning given Vim's widespread use across development environments, system administration tools, and automated systems where users might unknowingly process malicious spell files. The vulnerability demonstrates how seemingly benign configuration or data processing functions can become entry points for more serious security compromises.
The operational impact of this vulnerability extends beyond simple memory corruption, as it could enable attackers to execute arbitrary code with the privileges of the user running Vim. This risk is elevated in environments where Vim is used for editing sensitive configuration files or when users process spell files from untrusted sources. The heap-based memory corruption creates opportunities for exploitation through techniques such as heap spraying or information disclosure attacks that leverage the corrupted memory state.
Mitigation strategies should prioritize immediate patching to version 9.2.0846 which addresses the core issue by ensuring proper reset of sl_sal_first[] values and implementing stricter validation of spell file section ordering. Organizations should also implement restrictive access controls for spell files, particularly in multi-user environments where spell files might be processed automatically or from untrusted sources. Additional protective measures include deploying runtime monitoring tools that can detect anomalous memory access patterns and ensuring that spell file processing occurs in restricted execution contexts with appropriate privilege separation. The vulnerability demonstrates the importance of proper state management in complex software systems and highlights how seemingly isolated function interactions can create exploitable conditions.
This issue exemplifies the types of vulnerabilities that commonly arise in text processing and parsing functions, where assumptions about data ordering and memory state can lead to serious security implications. The fix implemented in version 9.2.0846 represents a standard defensive programming approach that ensures proper initialization and cleanup of internal data structures, preventing the carryover of state information between different spell file sections. The vulnerability serves as a reminder of the critical need for thorough testing of data processing pipelines, particularly those involving user-supplied or externally sourced configuration files in widely deployed software applications.