CVE-2026-45130

What it actually does

This vulnerability is a heap buffer overflow in Vim's spell-file parser, specifically read_compound() in src/spellfile.c, when parsing a crafted .spl spell file while UTF-8 encoding is active. An attacker-controlled length value in the compound section can trigger a 32-bit signed integer multiplication overflow, causing Vim to allocate a buffer that is too small and then write beyond its bounds during a loop. The practical result is memory corruption in the Vim process, which can lead to denial of service and may allow limited confidentiality or integrity impact depending on allocator behavior, platform protections, and exploit reliability. Exploitation requires user interaction, typically opening a text file or otherwise causing Vim to load the malicious spell file, and also requires the crafted .spl file to be reachable through Vim's runtimepath. The issue is fixed in Vim 9.2.0450.

Why it matters to the business

Successful exploitation can crash Vim or potentially corrupt memory during editing sessions, disrupting developer, administrator, or operations workflows that rely on Vim. In higher-risk scenarios, if attackers can plant files in locations searched by Vim or influence files opened by users, they may be able to trigger code execution-like outcomes depending on the platform, although the published severity indicates limited confidentiality and integrity impact with high availability impact. Because exploitation requires a crafted spell file and user interaction, broad internet-scale exploitation is less likely; EPSS is low and the issue is not listed in CISA KEV. However, Vim and Neovim are widely deployed on developer workstations, servers, containers, and administrative systems, so organizations should treat vulnerable versions as a supply-chain and workstation hardening concern, especially where users open untrusted repositories, archives, or text files.

How an attack unfolds

An attacker prepares a malicious Vim spell file with a crafted compound section that contains a length field designed to overflow a signed 32-bit multiplication in read_compound(). The attacker then needs the malicious .spl file to be placed somewhere Vim searches via its runtimepath. Separately, the attacker provides or influences a text file that a victim opens in Vim. If that file contains a modeline that sets the spelllang option, Vim may attempt to load the corresponding spell file while UTF-8 encoding is active. When the vulnerable parser processes the malicious .spl file, it allocates an undersized heap buffer and then writes past the allocation, corrupting heap memory. The likely immediate effect is a Vim crash, but memory corruption can sometimes be shaped into more serious outcomes depending on operating system mitigations, build options, memory allocator behavior, and exploit development effort. No public exploit maturity or known KEV/ransomware use is indicated in the supplied data.

How to fix it

Upgrade Vim to version 9.2.0450 or later. Where Neovim packages include or depend on affected Vim spell-file parsing behavior, apply the vendor-provided Neovim update when available and track distribution advisories for the exact fixed package version. If immediate patching is not possible, reduce exposure by disabling modelines for untrusted files with 'set nomodeline', avoiding opening untrusted repositories or text files in vulnerable Vim builds, restricting writable directories on Vim's runtimepath, removing untrusted .spl files, and preventing project-local or user-writable spell files from being automatically loaded. On managed endpoints and servers, update OS packages rather than only upstream source where Vim is installed through a distribution package manager. Also rebuild or refresh containers and developer images that contain vulnerable Vim/Neovim versions.

How to confirm the fix worked

Confirm that Vim reports version 9.2.0450 or later using 'vim --version' or the relevant package manager inventory. For distribution packages, verify that the installed package includes the vendor backport for this issue even if the upstream version string differs. Review Vim runtimepath locations using ':set runtimepath?' and confirm they are not writable by untrusted users or populated from untrusted project directories. Check Vim configuration for modeline handling with ':set modeline?' and consider confirming that modelines are disabled where untrusted files are opened. Validate that no untrusted .spl files exist in user, project, plugin, or shared runtime spell directories. For golden images and containers, rescan the final built artifact, not just the base image, to ensure vulnerable Vim or Neovim binaries were not reintroduced.

Typical attack path

1. Identify targets likely to use Vim or Neovim to open untrusted text files, source repositories, configuration files, or archives.
2. Create a malicious .spl spell file whose compound section triggers the integer overflow and heap buffer overflow in read_compound().
3. Place or induce placement of the malicious .spl file in a directory included in Vim's runtimepath, such as through a repository, plugin path, user configuration path, shared runtime directory, or writable package location.
4. Deliver a text file that includes a modeline or other configuration path that causes Vim to set spelllang and load the attacker's crafted spell file with UTF-8 encoding active.
5. Wait for the victim to open the text file in a vulnerable Vim version prior to 9.2.0450.
6. Trigger parsing of the crafted spell file, causing heap corruption in the Vim process.
7. Cause denial of service through process crash or attempt to leverage memory corruption for further impact if exploit reliability and target mitigations allow it.

How to detect it

To determine whether this was already exploited, focus on endpoint and file-system artifacts rather than network telemetry because exploitation is local and user-interaction driven. Review shell history, EDR process telemetry, crash reports, and system logs for Vim or Neovim crashes shortly after opening untrusted files, repositories, or archives. Look for malicious or unusual .spl files in Vim spell directories, plugin directories, project trees, home-directory Vim configuration paths, shared runtime directories, and package-managed runtime paths. Search text files recently opened by users for Vim modelines that set spelllang or otherwise influence spell loading. Investigate any sequence where a user opened a file in vulnerable Vim, Vim loaded a nonstandard spell file from a writable or project-controlled runtimepath, and the process crashed with heap corruption, SIGSEGV, SIGABRT, malloc corruption, or similar memory allocator errors. On Linux, relevant sources include journalctl, syslog, apport, systemd-coredump, auditd, EDR file/process events, shell history, and core dump metadata. On macOS, review CrashReporter, unified logs, endpoint telemetry, and Homebrew/MacPorts package logs. On Windows builds, review Event Viewer Application logs, WER crash reports, EDR telemetry, and file creation events for .spl files. There are no unique public attacker infrastructure indicators supplied; detection should be behavior- and artifact-based.

• read_compound
• src/spellfile.c
• *.spl
• spelllang=
• vim: set spelllang
• vi: set spelllang
• ex: set spelllang
• set spelllang=
• modeline
• runtimepath
• spell/
• ~/.vim/spell/
• ~/.vim/pack/
• ~/.config/nvim/spell/
• ~/.local/share/nvim/site/spell/
• /usr/share/vim/vimfiles/spell/
• /usr/local/share/vim/vimfiles/spell/
• /usr/share/vim/vim*/spell/
• /usr/share/nvim/site/spell/
• vim: memory allocation error
• vim: line too long
• malloc(): corrupted top size
• malloc(): invalid size
• malloc(): corrupted unsorted chunks
• double free or corruption
• corrupted size vs. prev_size
• free(): invalid pointer
• munmap_chunk(): invalid pointer
• SIGSEGV
• SIGABRT
• core dumped
• systemd-coredump
• Process: vim
• Process: nvim
• vim.exe
• nvim.exe

What your security team should do

• Prioritize upgrading Vim to 9.2.0450 or later across developer workstations, administrative jump hosts, servers, containers, and build images.
• Track Linux distribution, BSD, macOS package manager, and Neovim advisories for backported fixes where version strings may not exactly match upstream Vim 9.2.0450.
• Temporarily disable modelines for users who regularly open untrusted files, repositories, support bundles, or archives in Vim.
• Audit Vim runtimepath directories and remove untrusted or unexpectedly writable spell-file locations, especially directories containing .spl files.
• Search source repositories, shared folders, and recently downloaded archives for suspicious .spl files and Vim modelines that set spelllang.
• Educate engineering and operations users not to open untrusted files in vulnerable Vim versions until patched.
• Add software inventory checks for Vim and Neovim versions to endpoint, server, and container vulnerability management workflows.
• Because EPSS is low and there is no KEV listing or known ransomware use, handle this as important patch hygiene rather than an emergency internet-facing incident unless local evidence suggests exploitation.