CVE-2026-57455 Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument

Medium 4.0 Published 25 Jun 2026 Updated 25 Jun 2026

A stack out-of-bounds write in Vim's spell checker allows attackers to crash the editor by providing an over-length word when a SOFO-based spell language is active.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-57455?

CVE-2026-57455 is a medium-severity memory corruption vulnerability in Vim Vim, published on 25 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.

Weakness: CWE-787

Which versions are affected by CVE-2026-57455?

It affects 1 product.

Products include Vim Vim.

How do I fix CVE-2026-57455?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-57455 being exploited?

There is no known exploitation of CVE-2026-57455 in the wild and no public exploit code.

All Vim Vim vulnerabilities

Sources

Also known as ALPINE-CVE-2026-57455, AZL-91101, BELL-CVE-2026-57455, DEBIAN-CVE-2026-57455, ECHO-b8e1-3ec5-6440, GHSA-q8mh-6qm3-25g4 and 4 more.