Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M
CVE-2026-73072Vim: Heap Buffer Overflow when Loading a Spell File
High 8.5
In plain English
A high-severity heap buffer overflow in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | vim-X11 | 2:9.1.083-9.el10_2.20 | ALSA-2026:66336 |
| AlmaLinux:8 | vim-X11 | 2:8.0.1763-31.el8_10.7 | ALSA-2026:66348 |
| AlmaLinux:9 | vim-X11 | 2:8.2.2637-26.el9_8.21 | ALSA-2026:66366 |
| AlmaLinux:10 | vim-common | 2:9.1.083-9.el10_2.20 | ALSA-2026:66336 |
| AlmaLinux:8 | vim-common | 2:8.0.1763-31.el8_10.7 | ALSA-2026:66348 |
| AlmaLinux:9 | vim-common | 2:8.2.2637-26.el9_8.21 | ALSA-2026:66366 |
| AlmaLinux:10 | vim-data | 2:9.1.083-9.el10_2.20 | ALSA-2026:66336 |
| AlmaLinux:10 | vim-enhanced | 2:9.1.083-9.el10_2.20 | ALSA-2026:66336 |
| AlmaLinux:8 | vim-enhanced | 2:8.0.1763-31.el8_10.7 | ALSA-2026:66348 |
| AlmaLinux:9 | vim-enhanced | 2:8.2.2637-26.el9_8.21 | ALSA-2026:66366 |
| AlmaLinux:10 | vim-filesystem | 2:9.1.083-9.el10_2.20 | ALSA-2026:66336 |
| AlmaLinux:8 | vim-filesystem | 2:8.0.1763-31.el8_10.7 | ALSA-2026:66348 |
| AlmaLinux:9 | vim-filesystem | 2:8.2.2637-26.el9_8.21 | ALSA-2026:66366 |
| AlmaLinux:10 | vim-minimal | 2:9.1.083-9.el10_2.20 | ALSA-2026:66336 |
| AlmaLinux:8 | vim-minimal | 2:8.0.1763-31.el8_10.7 | ALSA-2026:66348 |
| AlmaLinux:9 | vim-minimal | 2:8.2.2637-26.el9_8.21 | ALSA-2026:66366 |
| AlmaLinux:10 | xxd | 2:9.1.083-9.el10_2.20 | ALSA-2026:66336 |
| Alpine:v3.23 | vim | 9.2.0854-r0 | ALPINE-CVE-2026-73072 |
| Alpine:v3.24 | vim | 9.2.0854-r0 | ALPINE-CVE-2026-73072 |
| Debian:12 | vim | no fix listed | DEBIAN-CVE-2026-73072 |
| Debian:13 | vim | 2:9.1.1230-2+deb13u1 | DEBIAN-CVE-2026-73072 |
| Debian:14 | vim | 2:9.2.0858-1 | DEBIAN-CVE-2026-73072 |
| Rocky Linux:10 | vim | 2:9.1.083-9.el10_2.20 | RLSA-2026:66336 |
| Rocky Linux:8 | vim | 2:8.0.1763-31.el8_10.7 | RLSA-2026:66348 |
| Rocky Linux:9 | vim | 2:8.2.2637-26.el9_8.21 | RLSA-2026:66366 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.35 | UBUNTU-CVE-2026-73072 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.35 | USN-8657-1 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.19 | UBUNTU-CVE-2026-73072 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.19 | USN-8657-1 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu4.8 | UBUNTU-CVE-2026-73072 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu4.8 | USN-8657-1 |
Affected products (as reported)
Weakness: CWE-122, CWE-787 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64 x_refsource_CONFIRM
- https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a x_refsource_MISC
- https://github.com/vim/vim/releases/tag/v9.2.0846 x_refsource_MISC