Stack Out-of-Bounds Write in Vim Text Editor

Executive Summary

CVE-2026-57455 is a stack-based out-of-bounds write vulnerability in the Vim text editor versions prior to 9.2.0698. It occurs in the function spell_soundfold_sofo() within src/spell.c, which translates words using a spell file's SOFO (sound-folding) byte map.

The vulnerability arises because the single-byte branch of this function copies input bytes into a fixed-size stack buffer without proper bounds checking. Specifically, the copy loop advances an output index without limiting it to the buffer's maximum length (MAXWLEN). If a word longer than MAXWLEN (253 bytes) is processed, the function writes past the end of the buffer, corrupting the call frame and causing the editor to crash.

This issue is triggered when using a non-multibyte 8-bit encoding like latin1, with spell checking enabled for a SOFO-based language, and processing an overly long word, such as from untrusted input in a script or plugin. The vulnerability was fixed in Vim version 9.2.0698 by adding proper bounds checking.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Vim editor to crash due to stack corruption when processing specially crafted long words under certain spell checking conditions.

Because the out-of-bounds write corrupts the call frame, it could potentially be exploited to execute arbitrary code, although exploitation requires specific conditions such as using an 8-bit encoding like latin1, enabling spell checking with a SOFO-based language, and processing untrusted input.

In practical terms, this means an attacker could cause denial of service by crashing Vim or potentially execute malicious code if they can control the input to the soundfold() function.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as a stack out-of-bounds write in Vim when processing words longer than 253 bytes under a SOFO-based spell language with single-byte encoding (e.g., latin1). Detection involves verifying the Vim version and configuration.

• Check the installed Vim version to see if it is prior to 9.2.0698, which is vulnerable.
• Verify if Vim is configured to use a single-byte encoding such as latin1 by running: vim --cmd 'set encoding?' -c 'q'
• Check if spell checking is enabled with a SOFO-based spell language active.
• Attempt to reproduce the crash by invoking spell suggestions on words longer than 253 bytes in Vim with the above configuration.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Vim to version 9.2.0698 or later, where the vulnerability has been fixed.

Alternatively, if upgrading immediately is not possible, avoid using single-byte encodings like latin1 with SOFO-based spell checking enabled, and avoid processing or accepting untrusted input that could trigger the soundfold() function on overly long words.

Disabling spell checking or switching to UTF-8 encoding, which uses a safe multibyte branch with bounds checking, can also reduce risk.

Useful 0 Not Useful 0