CVE-2026-55892

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.

• CWE-787

• https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241fPatch
• https://github.com/vim/vim/releases/tag/v9.2.0662Product
• https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879hVendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55883Tilt defines dev environments as code for microservice apps …8.3
• CVE-2026-55884Tilt defines dev environments as code for microservice apps …9.2
• CVE-2026-55885Grav is a file-based Web platform. Prior to 1.7.53, an authe…6.8
• CVE-2026-55886Jodit Editor is a WYSIWYG editor with written in pure TypeSc…6.3
• CVE-2026-5589An integer underflow in bt_mesh_sol_recv() in the Bluetooth …6.3
• CVE-2026-55890Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav…4.8
• CVE-2026-55895Vim is an open source, command line text editor. Prior to 9.…7.8
• CVE-2026-55898Out-of-bounds read in Microsoft Office Excel allows an unaut…7.1
• CVE-2026-55899Stack-based buffer overflow in Microsoft Office Excel allows…7.8
• CVE-2026-5590A race condition during TCP connection teardown can cause tc…5.3
• CVE-2026-5594A weakness has been identified in premAI-io premsql up to 0.…6.3
• CVE-2026-55944Deserialization of untrusted data in Microsoft Dynamics NAV …9.8