Vulnerability · Published May 8, 2026 · Assigned by GitHub_M
CVE-2026-45130Vim: Heap Buffer Overflow in spell file loading
Medium 6.6
In plain English
A medium-severity heap buffer overflow in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | vim | 9.2.0452-r0 | ALPINE-CVE-2026-45130 |
| Alpine:v3.24 | vim | 9.2.0452-r0 | ALPINE-CVE-2026-45130 |
| Debian:12 | vim | no fix listed | DEBIAN-CVE-2026-45130 |
| Debian:13 | vim | 2:9.1.1230-2+deb13u1 | DEBIAN-CVE-2026-45130 |
| Debian:14 | vim | 2:9.2.0461-1 | DEBIAN-CVE-2026-45130 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.30 | USN-8304-1 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.30 | UBUNTU-CVE-2026-45130 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.14 | USN-8304-1 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.14 | UBUNTU-CVE-2026-45130 |
| Ubuntu:25.10 | vim | 2:9.1.0967-1ubuntu6.5 | USN-8304-1 |
| Ubuntu:25.10 | vim | 2:9.1.0967-1ubuntu6.5 | UBUNTU-CVE-2026-45130 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu4.2 | UBUNTU-CVE-2026-45130 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu4.2 | USN-8304-1 |
Affected products (as reported)
Weakness: CWE-122, CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H