Buffer Overflow in Vim Text Editor via SAL Sound-Folding Rules

Executive Summary

This vulnerability exists in Vim, an open source command line text editor, specifically in versions prior to 9.2.0725. The issue is in the single-byte branch of the function spell_soundfold_sal() located in src/spell.c. The function translates a word using a spell file's SAL sound-folding rules into a buffer owned by the caller. However, the code only checks that the length of the result (reslen) is less than MAXWLEN before writing a null byte, allowing reslen to reach MAXWLEN and causing a write one byte past the end of the stack buffer. This buffer overflow can occur when a boundary-length word is processed through soundfold() or during sound-based spell suggestions with a SAL-based spell language active under a non-multibyte 8-bit encoding. The overflow can corrupt the eval_soundfold() stack frame and crash the editor.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Vim editor to crash due to stack corruption when processing certain words with sound-based spell suggestions under specific encoding conditions. While it does not directly indicate remote code execution or data leakage, the crash can disrupt normal use of the editor and potentially lead to denial of service for users relying on Vim.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Vim to version 9.2.0725 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs in Vim versions prior to 9.2.0725 when using a non-multibyte 8-bit encoding (e.g., latin1) with spell checking enabled for a SAL-based spell language. Detection involves verifying the Vim version and configuration.

• Check the installed Vim version to see if it is older than 9.2.0725: `vim --version`
• Within Vim, check the encoding setting: `:set encoding?` (should not be a non-multibyte 8-bit encoding like latin1 to be vulnerable)
• Check if spell checking is enabled and using a SAL-based spell language: `:set spell?` and inspect the spell language with `:set spelllang?`

Because the vulnerability triggers on processing a boundary-length word (exactly MAXWLEN bytes) through the soundfold() function with SAL rules, direct detection on a network or system would involve attempting to reproduce the crash by passing crafted input to Vim under these conditions.

No specific network commands or automated detection scripts are provided in the resources. Manual verification of Vim version and configuration is the primary detection method.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of CVE-2026-59857 on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0