CVE-2026-45130

Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.

CVSS v3 6.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8	Patch
https://github.com/vim/vim/releases/tag/v9.2.0450	Product
https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv	Exploit Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/14/3	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:neovim:neovim::::::::
	cpe:2.3:a:vim:vim::::::::

History

No history.

Information

Published : 2026-05-08 23:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-45130

Mitre link : CVE-2026-45130

CVE.ORG link : CVE-2026-45130

JSON object : View

Products Affected

neovim

neovim

vim

vim

CWE

CWE-122

Heap-based Buffer Overflow

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-45130", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45130", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T13:10:12.632073Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vim", "product": "vim", "versions": [{"status": "affected", "version": "< 9.2.0450"}]}]}], "published": "2026-05-08T23:16:40.053", "references": [{"url": "https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vim/vim/releases/tag/v9.2.0450", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/14/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450."}, {"lang": "es", "value": "Vim es un editor de texto de c\u00f3digo abierto, de l\u00ednea de comandos. Antes de la versi\u00f3n 9.2.0450, existe un desbordamiento de b\u00fafer en el heap en read_compound() en src/spellfile.c al cargar un archivo de diccionario (.spl) manipulado con la codificaci\u00f3n UTF-8 activa. Un campo de longitud controlado por el atacante en la secci\u00f3n de compuestos del archivo de diccionario desborda una multiplicaci\u00f3n de enteros con signo de 32 bits, provocando que se asigne un b\u00fafer peque\u00f1o para un bucle de escritura que ejecuta muchas iteraciones, desbordando el heap. Debido a que la opci\u00f3n 'spelllang' puede establecerse desde una modeline, una modeline de archivo de texto puede activar la carga del archivo de diccionario si se ha colocado un archivo .spl malicioso en el runtimepath. Este problema ha sido parcheado en la versi\u00f3n 9.2.0450."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:neovim:neovim:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "719B9CF2-2B89-42FC-9CE0-57D380FDDA35", "versionEndIncluding": "0.12.2"}, {"criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0FC2B37-D8F8-4D00-AFD5-9DF3C7BE1E1B", "versionEndExcluding": "9.2.0450"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}