CVE-2026-57455

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.

• CWE-787

• https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41bPatch
• https://github.com/vim/vim/releases/tag/v9.2.0698Product
• https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4Vendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57439CyberChef is a web app for encryption, encoding, compression…5
• CVE-2026-5745A flaw was found in libarchive. A NULL pointer dereference v…5.5
• CVE-2026-57451Vim is an open source, command line text editor. Prior to 9.…6.1
• CVE-2026-57452Vim is an open source, command line text editor. Prior to 9.…5.5
• CVE-2026-57453Vim is an open source, command line text editor. From 9.1.17…7.3
• CVE-2026-57454Vim is an open source, command line text editor. From 9.2.03…6.1
• CVE-2026-57456Vim is an open source, command line text editor. Prior to 9.…7.8
• CVE-2026-5747An out-of-bounds write issue in the virtio PCI transport in …8.7
• CVE-2026-57473A vulnerability exists in the netclient and factory services…5.8
• CVE-2026-57474Deloitte AI Assist for Customer disclosed some configuration…6.9
• CVE-2026-57475Deloitte AI Assist for Customer accepted unauthenticated POS…6.9
• CVE-2026-57476Deloitte AI Assist for Customer exposed unauthenticated API …6.3