Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade vim | Jun 26, 2026 | Jun 25, 2026 |
| Amazon_linux_2023 | — | Upgrade vim-minimal-debuginfoUpgrade xxd-debuginfoUpgrade vim-default-editorUpgrade vim-debugsourceUpgrade vim-filesystemUpgrade vim-debuginfoUpgrade vim-commonUpgrade vim-enhancedUpgrade vim-enhanced-debuginfoUpgrade vim-minimalUpgrade xxdUpgrade vim-data | Jul 21, 2026 | Jun 25, 2026 |
| Redhat_linux | — | Upgrade vim-common-debuginfoUpgrade vim-commonUpgrade vim-dataUpgrade vim-debugsourceUpgrade vim-filesystemUpgrade vim-enhanced-debuginfoUpgrade vim-minimalUpgrade vim-enhancedUpgrade vim-X11Upgrade vim-debuginfoUpgrade xxdUpgrade vim-X11-debuginfoUpgrade xxd-debuginfoUpgrade vim-minimal-debuginfoNo solution exists | Jul 17, 2026 | Jun 25, 2026 |
| Rocky_linux | — | Upgrade vim-commonUpgrade vim-X11-debuginfoUpgrade vim-common-debuginfoUpgrade vim-debuginfoUpgrade vim-X11Upgrade xxd-debuginfoUpgrade vim-minimal-debuginfoUpgrade vim-debugsourceUpgrade vim-minimalUpgrade vim-enhancedUpgrade vim-enhanced-debuginfoUpgrade xxd | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade vim-runtime (Ubuntu Pro)Upgrade vim-gtk3Upgrade vim-athena-py2 (Ubuntu Pro)Upgrade xxd (Ubuntu Pro)Upgrade vim-gui-commonUpgrade vimUpgrade vim-gtk-py2 (Ubuntu Pro)Upgrade xxdUpgrade vim-gnome-py2 (Ubuntu Pro)Upgrade vim-motifUpgrade vim-lesstif (Ubuntu Pro)Upgrade vim (Ubuntu Pro)Upgrade vim-tinyUpgrade vim-athenaUpgrade vim-common (Ubuntu Pro)Upgrade vim-nox (Ubuntu Pro)Upgrade vim-athena (Ubuntu Pro)Upgrade vim-runtimeUpgrade vim-commonUpgrade vim-noxUpgrade vim-gtk (Ubuntu Pro)Upgrade vim-gtk3 (Ubuntu Pro)Upgrade vim-tiny (Ubuntu Pro)Upgrade vim-gtkUpgrade vim-gnome (Ubuntu Pro)Upgrade vim-nox-py2 (Ubuntu Pro)Upgrade vim-gui-common (Ubuntu Pro)Upgrade vim-gtk3-py2 (Ubuntu Pro) | Jul 5, 2026 | Jul 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 6, 2026 | Jun 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub