Vim up to 9.2.652 src/spellfile.c tree_count_words word-count out-of-bounds write

Summaryinfo

A vulnerability classified as critical has been found in Vim up to 9.2.652. This affects the function tree_count_words of the file src/spellfile.c. The manipulation of the argument word-count leads to out-of-bounds write. This vulnerability is referenced as CVE-2026-55693. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Vim up to 9.2.652. This issue affects the function tree_count_words of the file src/spellfile.c. The manipulation of the argument word-count with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-55693 since 06/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 323787 (Linux Distros Unpatched Vulnerability : CVE-2026-55693), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.2.0653 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (323787) and CERT Bund (WID-SEC-2026-1926). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• Open Source vim

Productinfo

Type

• Word Processing Software

Name

• Vim

Version

• 9.2.652

License

• open-source

Website

• Product: https://github.com/vim/vim/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion