CVE-2026-73072
Received Received - Intake

Heap Overflow in Vim Text Editor

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73072
EUVD
EUVD-2026-56226

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vim vim to 9.2.0846 (inc)
vim vim 9.2.0846

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73072 is a heap buffer overflow in Vim's set_sofo() function. It occurs when a crafted spell file contains an SN_SAL section followed by an SN_SOFO section with multi-byte characters sharing the same low byte. This causes set_sal_first() to set sl_sal_first[] to -1, leading set_sofo() to undercount colliding characters, allocate an undersized list, and write past allocated memory.

Detection Guidance

Check Vim version with 'vim --version' or 'vim -v'. If version is below 9.2.0846, the system is vulnerable. Inspect spell files loaded via 'spelllang' for unusual SN_SAL or SN_SOFO sections.

Impact Analysis

An attacker could exploit this by tricking a user into loading a malicious spell file via the 'spelllang' option. This could lead to arbitrary code execution, data corruption, or denial of service on the affected system. The attacker needs to craft a specific spell file to trigger the overflow.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a heap buffer overflow in Vim's spell file handling that could allow arbitrary code execution if exploited, but no evidence suggests it impacts data protection or privacy requirements under these regulations.

Mitigation Strategies

Upgrade Vim to version 9.2.0846 or later. Avoid loading untrusted spell files. Disable spell checking if not needed or restrict spell file sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73072. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart