CVE-2026-73072: Vim Buffer Overflow Vulnerability

CVE-2026-73072 Overview

CVE-2026-73072 is a heap buffer overflow [CWE-122] in the Vim command-line text editor. The flaw resides in set_sofo() within src/spellfile.c. The function reuses sl_sal_first[] without resetting values left by a prior set_sal_first() call. A crafted spell file that places an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and produces attacker-influenced writes beyond a heap allocation. All Vim versions prior to 9.2.0846 are affected. The maintainers fixed the issue in version 9.2.0846 by explicitly zeroing sl_sal_first[] before reuse.

Critical Impact
A malicious spell file loaded by Vim can trigger out-of-bounds heap writes, leading to memory corruption and potential local code execution in the context of the user running Vim.

Affected Products

Vim versions prior to 9.2.0846
Any distribution or application bundling a vulnerable Vim build
Environments processing untrusted .spl spell files with Vim

Discovery Timeline

2026-08-11 - CVE-2026-73072 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-73072

Vulnerability Analysis

The vulnerability is a heap buffer overflow in Vim's spell file parser. Vim spell files contain optional sections such as SN_SAL (sound-alike mappings) and SN_SOFO (sound-folding mappings). The parser first calls set_sal_first() when handling an SN_SAL section. That function initializes entries in sl_sal_first[] to -1 as sentinel values.

When the parser subsequently reaches an SN_SOFO section, set_sofo() reuses the same sl_sal_first[] array as scratch space to count mapping list sizes. Because the sentinel values from the prior SN_SAL section were never cleared, the counters start negative. The resulting under-counted list lengths cause the subsequent allocation to be undersized while later code writes more entries than the allocation can hold.

Root Cause

The root cause is missing state reinitialization between two parser stages that share a scratch buffer. set_sofo() assumed sl_sal_first[] was zeroed, but a preceding SN_SAL section leaves stale -1 sentinels behind. This produces a classic heap-based buffer overflow [CWE-122] whose size and content are influenced by attacker-controlled fields in the spell file.

Attack Vector

Exploitation requires a local user to open or load a crafted spell file with Vim, for example via :setlocal spell spelllang=... or by opening a file that triggers spell handling. The attack vector is local and requires user interaction, but no privileges are needed. Successful exploitation corrupts heap memory in the Vim process and may lead to arbitrary code execution as the invoking user.

 	lp->sl_sofo = TRUE;
 
 	// First count the number of items for each list.  Temporarily use
-	// sl_sal_first[] for this.
+	// sl_sal_first[] for this.  Reset it first: a preceding SN_SAL section
+	// may have set the entries to -1 via set_sal_first().
+	vim_memset(lp->sl_sal_first, 0, sizeof(salfirst_T) * 256);
 	for (p = from, s = to; *p != NUL && *s != NUL; )
 	{
 	    c = mb_cptr2char_adv(&p);

Source: Vim commit 05c41c9 — the patch adds a vim_memset() call to zero sl_sal_first[] before set_sofo() reuses it.

Detection Methods for CVE-2026-73072

Indicators of Compromise

Unexpected Vim process crashes or SIGSEGV signals when opening files that reference spell dictionaries
Presence of untrusted .spl or .sug files in user runtime paths such as ~/.vim/spell/ or $VIMRUNTIME/spell/
Spell files whose section ordering places an SN_SAL block before an SN_SOFO block, which is unusual for legitimate dictionaries
Vim child processes spawning unexpected shells or network connections after opening a document

Detection Strategies

Inventory installed Vim binaries across Linux, macOS, and Windows endpoints and compare versions against 9.2.0846
Hunt for delivery of .spl files through email, chat, and web download telemetry
Correlate file-open events for Vim with subsequent process crashes or memory faults in endpoint telemetry

Monitoring Recommendations

Enable core dump collection on developer workstations and CI hosts to capture heap corruption evidence
Alert on Vim spawning interpreters such as sh, bash, python, or perl outside of expected editor macros
Monitor write activity to ~/.vim/spell/ and system-wide spell directories for changes originating from non-package-manager processes

How to Mitigate CVE-2026-73072

Immediate Actions Required

Upgrade Vim to version 9.2.0846 or later on all systems, including container base images and developer VMs
Remove or quarantine any untrusted .spl spell files in user and system spell directories
Instruct users to avoid opening spell dictionary files received from untrusted sources

Patch Information

The fix is available in Vim 9.2.0846. The patch in src/spellfile.c adds vim_memset(lp->sl_sal_first, 0, sizeof(salfirst_T) * 256) at the start of set_sofo() so stale -1 sentinels from a prior set_sal_first() call cannot underflow the item counters. Refer to the GitHub Security Advisory GHSA-9jqx-hgpr-6v64 and the Vim v9.2.0846 release notes for details.

Workarounds

Disable spell checking by ensuring set nospell is applied and avoid :setlocal spell on untrusted files
Restrict runtimepath and spellfile locations to trusted directories owned by root or a package manager
Run Vim under a sandbox such as firejail or bubblewrap when opening files from untrusted origins

bash

# Verify installed Vim version and disable spell loading in vimrc
vim --version | head -1

# Add to ~/.vimrc to disable spell by default
echo 'set nospell' >> ~/.vimrc

# Remove untrusted spell files
find ~/.vim/spell -type f \( -name '*.spl' -o -name '*.sug' \) -print