CVE-2026-55892

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.(CVE-2026-55693)

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.(CVE-2026-55892)

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.(CVE-2026-55895)

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.(CVE-2026-55693)

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.(CVE-2026-55892)

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.(CVE-2026-55895)

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.(CVE-2026-55693)

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.(CVE-2026-55892)

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.(CVE-2026-55895)

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.(CVE-2026-55693)

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.(CVE-2026-55892)

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!. This vulnerability is fixed in 9.2.0663.(CVE-2026-55895)

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)

• vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)

• vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)

• vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)

• vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)

• vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)

• vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)

• vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)

• vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)

• vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)

• vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)

• vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)

• vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)

• vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)

• vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)

• vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)

• vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)

• vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)

• vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)

• vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)

• vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)
• vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)
• vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)
• vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)
• vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)
• vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)
• vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)
• vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)
• vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)
• vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)
• vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)
• vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)
• vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)
• vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)
• vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)
• vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)
• vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)
• vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)
• vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)
• vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)
• vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.

• CVE-2026-55693: fix out-of-bounds write in tree_count_words()
• CVE-2026-55892: fix out-of-bounds write in dump_prefixes()
• CVE-2026-57455: fix out-of-bounds write in soundfold()
• CVE-2026-57456: fix code execution in Python omni-completion

• CVE-2026-55693: fix out-of-bounds write in tree_count_words()
• CVE-2026-55892: fix out-of-bounds write in dump_prefixes()
• CVE-2026-57455: fix out-of-bounds write in soundfold()
• CVE-2026-57456: fix code execution in Python omni-completion

• CVE-2026-55693: fix out-of-bounds write in tree_count_words()
• CVE-2026-55892: fix out-of-bounds write in dump_prefixes()
• CVE-2026-57455: fix out-of-bounds write in soundfold()
• CVE-2026-57456: fix code execution in Python omni-completion

• SECURITY UPDATE: out-of-bounds write parsing a crafted spell file: tree_count_words() and sug_filltree() descended the word trie without bounding the recursion depth, so a deeply nested trie wrote past the ends of their MAXWLEN-sized arridx[], curi[] and wordcount[] arrays.
  • debian/patches/CVE-2026-55693.patch: only descend while depth < MAXWLEN - 1 in both trie walkers, in src/spell.c; matches upstream patch 9.2.0653.
  • CVE-2026-55693
• SECURITY UPDATE: stack out-of-bounds write in dump_prefixes() when dumping spell prefixes (:spelldump): the word trie was descended without bounding the recursion depth, overflowing the MAXWLEN-sized prefix[], arridx[] and curi[] arrays.
  • debian/patches/CVE-2026-55892.patch: only descend while depth < MAXWLEN - 1, in src/spell.c; matches upstream patch 9.2.0662.
  • CVE-2026-55892
• SECURITY UPDATE: out-of-bounds write in soundfold(): the single-byte branch of spell_soundfold_sofo() wrote one result byte per input byte into the MAXWLEN-sized res[] buffer with no bound, so a long word overflowed it.
  • debian/patches/CVE-2026-57455.patch: stop the translation loop once ri reaches MAXWLEN - 1, in src/spell.c; matches upstream patch 9.2.0698.
  • CVE-2026-57455
• SECURITY UPDATE: arbitrary code execution in the python and python3 omni-completion plugins: reconstructed class/function definitions ran through exec() embedded buffer-supplied docstrings inside a triple- quoted Python string literal, so a docstring containing a closing triple-quote broke out of the literal and executed attacker code.
  • debian/patches/CVE-2026-57456.patch: quote docstrings with repr() instead of triple-quoting, in runtime/autoload/python3complete.vim and pythoncomplete.vim; matches upstream patch 9.2.0699.
  • CVE-2026-57456

• CVE-2026-55693: bound the trie-descent depth counter against the MAXWLEN-element stack arrays in tree_count_words() to prevent an out-of-bounds write when reading a crafted spell file (src/spellfile.c, upstream vim 9.2.0653)
• CVE-2026-55892: bound the trie-descent depth counter in dump_prefixes() to prevent a stack out-of-bounds write with a crafted .spl spell file (src/spell.c, upstream vim 9.2.0662)
• CVE-2026-57455: bound the single-byte SOFO result copy in spell_soundfold_sofo() to MAXWLEN-1 to prevent a stack out-of-bounds write when sound-folding long words (src/spell.c, upstream vim 9.2.0698)
• CVE-2026-57456: use repr() on reconstructed docstrings in the python3 omni-completion so a hostile buffer cannot break out of the triple-quoted literal and execute arbitrary Python during completion (runtime/autoload/python3complete.vim, upstream vim 9.2.0699)

• CVE-2026-55892: fix out-of-bounds write in dump_prefixes()

• CVE-2026-55892: fix out-of-bounds write in dump_prefixes()

• CVE-2026-55892: fix out-of-bounds write in dump_prefixes()

• SECURITY UPDATE: Stack out-of-bounds write in dump_prefixes() in src/spell.c during :spelldump when a crafted spell file containing a self-referential BY_INDEX node in the prefix tree drives the descent depth past the MAXWLEN-sized prefix[]/arridx[]/curi[] stack arrays
  • debian/patches/CVE-2026-55892.patch: bound the prefix-tree descent in dump_prefixes() with "else if (depth < MAXWLEN - 1)" so the depth index cannot exceed the MAXWLEN-sized stack arrays
  • CVE-2026-55892

• CVE-2026-55693: bound the trie-descent depth counter against the MAXWLEN-element stack arrays in tree_count_words() to prevent an out-of-bounds write when reading a crafted spell file (src/spellfile.c, upstream vim 9.2.0653)
• CVE-2026-55892: bound the trie-descent depth counter in dump_prefixes() to prevent a stack out-of-bounds write with a crafted .spl spell file (src/spell.c, upstream vim 9.2.0662)
• CVE-2026-57455: bound the single-byte SOFO result copy in spell_soundfold_sofo() to MAXWLEN-1 to prevent a stack out-of-bounds write when sound-folding long words (src/spell.c, upstream vim 9.2.0698)
• CVE-2026-57456: use repr() on reconstructed docstrings in the python3 omni-completion so a hostile buffer cannot break out of the triple-quoted literal and execute arbitrary Python during completion (runtime/autoload/python3complete.vim, upstream vim 9.2.0699)

• CVE-2026-55892: fix out-of-bounds write in dump_prefixes()

The updated packages fix security vulnerabilities: Arbitrary Code Execution via Python Omni-Completion in Vim < 9.2.0561. (CVE-2026-52858) Out-of-bounds Read in Terminal Screen Snapshot in Vim < 9.2.0565. (CVE-2026-52859) Arbitrary Code Execution via Python Omni-Completion in Vim < 9.2.0597. (CVE-2026-52860) Out-of-bounds Write in Spell File Word Count in Vim < 9.2.0653. (CVE-2026-55693) Out-of-bounds Write in Spell File Prefix Dump in Vim < 9.2.0662. (CVE-2026-55892) Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename affects Vim < 9.2.0663. (CVE-2026-55895) Out-of-bounds Read in Text Property Count in Vim < 9.2.0670. (CVE-2026-57451) Out-of-bounds Read with libsodium-encrypted Files in Vim < 9.2.0671. (CVE-2026-57452) PowerShell Command Injection in zip.vim via Crafted Archive Entry Names in Vim > 9.1.1783 && Vim < 9.2.0678. (CVE-2026-57453) Out-of-bounds Read with Text Properties in Vim >= 9.2.0320 && Vim < 9.2.0679. (CVE-2026-57454) Out-of-bounds Write in SOFO Soundfolding in Vim < 9.2.0698. (CVE-2026-57455) Arbitrary Code Execution via Python Omni-Completion Docstrings in Vim < 9.2.0699. (CVE-2026-57456)

It was discovered that Vim incorrectly handled path traversal in the zip.vim plugin. An attacker could possibly use this issue to overwrite arbitrary files. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-35177)

It was discovered that Vim incorrectly handled depth tracking when processing spell files. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-55693, CVE-2026-55892)

It was discovered that Vim incorrectly handled filename escaping in the netrw plugin. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-55895)

It was discovered that Vim incorrectly handled length calculations when opening encrypted files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-57452)

Dhruv Vishesh Gupta discovered that Vim incorrectly handled quoting of archive entry names. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-57453)

It was discovered that Vim incorrectly handled bounds checking when translating words through a byte map. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-57455)

Chenyuan Mi discovered that Vim incorrectly handled docstring escaping during Python omni-completion. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-57456)