Out-of-bounds write in Vim - CVE-2026-55892
Published: June 18, 2026
Vulnerability identifier: #VU134881
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55892
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the dump_prefixes() function in src/spell.c when parsing a crafted .spl spell file during word list dumping. A remote attacker can supply a crafted spell file to cause a denial of service.
User interaction is required: spell checking must be enabled and the user must dump the word list, such as via :spelldump or spelling completion.
Affected software
Vim
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
vim (Ubuntu package)
vim (Red Hat package)
vim-filesystem
vim-X11
vim-common
vim-enhanced
vim-minimal
vim
vim-debugsource
vim-debuginfo
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
vim (Ubuntu package)
vim (Red Hat package)
vim-filesystem
vim-X11
vim-common
vim-enhanced
vim-minimal
vim
vim-debugsource
vim-debuginfo
How to mitigate CVE-2026-55892
Install security update from vendor's website.
Vim - update to 9.2.0662
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm30, 2:7.4.1689-3ubuntu1.5+esm36, 2:8.0.1453-1ubuntu1.13+esm21, 2:8.1.2269-1ubuntu5.32+esm9, 2:8.2.3995-1ubuntu2.33, 2:9.1.0016-1ubuntu7.17, 2:9.1.0967-1ubuntu6.8, 2:9.1.2141-1ubuntu4.6
vim (Red Hat package) - addressed in versions 8.0.1763-31.el8_10.7, 8.2.2637-26.el9_8.21, 9.1.083-9.el10_2.20
vim-filesystem - update to 8.0.1763-31.0.1
vim-X11 - update to 8.0.1763-31.0.1
vim-common - update to 8.0.1763-31.0.1
vim-enhanced - update to 8.0.1763-31.0.1
vim-minimal - update to 8.0.1763-31.0.1
vim - addressed in versions 9.0-51, 9.0.2092-37
vim-filesystem - addressed in versions 9.0-51, 9.0.2092-37
vim-minimal - addressed in versions 9.0-51, 9.0.2092-37
vim-enhanced - addressed in versions 9.0-51, 9.0.2092-37
vim-debugsource - addressed in versions 9.0-51, 9.0.2092-37
vim-debuginfo - addressed in versions 9.0-51, 9.0.2092-37
vim-common - addressed in versions 9.0-51, 9.0.2092-37
vim-X11 - addressed in versions 9.0-51, 9.0.2092-37
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm30, 2:7.4.1689-3ubuntu1.5+esm36, 2:8.0.1453-1ubuntu1.13+esm21, 2:8.1.2269-1ubuntu5.32+esm9, 2:8.2.3995-1ubuntu2.33, 2:9.1.0016-1ubuntu7.17, 2:9.1.0967-1ubuntu6.8, 2:9.1.2141-1ubuntu4.6
vim (Red Hat package) - addressed in versions 8.0.1763-31.el8_10.7, 8.2.2637-26.el9_8.21, 9.1.083-9.el10_2.20
vim-filesystem - update to 8.0.1763-31.0.1
vim-X11 - update to 8.0.1763-31.0.1
vim-common - update to 8.0.1763-31.0.1
vim-enhanced - update to 8.0.1763-31.0.1
vim-minimal - update to 8.0.1763-31.0.1
vim - addressed in versions 9.0-51, 9.0.2092-37
vim-filesystem - addressed in versions 9.0-51, 9.0.2092-37
vim-minimal - addressed in versions 9.0-51, 9.0.2092-37
vim-enhanced - addressed in versions 9.0-51, 9.0.2092-37
vim-debugsource - addressed in versions 9.0-51, 9.0.2092-37
vim-debuginfo - addressed in versions 9.0-51, 9.0.2092-37
vim-common - addressed in versions 9.0-51, 9.0.2092-37
vim-X11 - addressed in versions 9.0-51, 9.0.2092-37
External References
Related Security Bulletins
- Out-of-bounds write in Vim
- Ubuntu update for vim
- openEuler 22.03 LTS SP4 update for vim
- openEuler 24.03 LTS SP1 update for vim
- openEuler 20.03 LTS SP4 update for vim
- openEuler 24.03 LTS SP3 update for vim
- Red Hat Enterprise Linux 10 update for vim
- Red Hat Enterprise Linux 8 update for vim
- Red Hat Enterprise Linux 9 update for vim
- Anolis OS update for vim