Heap-based buffer overflow in Vim - CVE-2026-45130

Detailed vulnerability description

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in read_compound() in src/spellfile.c when loading a crafted .spl spell file with UTF-8 encoding active. A remote attacker can trick the victim into opening a text file with a crafted modeline or otherwise cause Vim to load a planted spell file to cause a denial of service.

User interaction is required, and exploitation requires a malicious .spl file to be present on the runtimepath while UTF-8 encoding is active.

How to mitigate CVE-2026-45130

Sources

• https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv
• https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8