Out-of-bounds write in Vim - CVE-2026-57455

Vulnerability identifier: #VU134977

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-57455

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the single-byte branch of spell_soundfold_sofo() in src/spell.c when processing an over-long word through SOFO sound-folding. A local user can supply a specially crafted over-long word to cause a denial of service.

The vulnerable path is only reached under a non-multibyte 8-bit encoding such as latin1, with spell checking enabled for a language that uses a SOFO sound-folding table.

Vim
Debian Linux
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server - AUS
Ubuntu
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
vim (Red Hat package)
vim-filesystem
vim-minimal
vim-enhanced
vim-common
vim-X11
vim-debuginfo
vim-debugsource
vim
vim (Ubuntu package)
vim (Debian package)

Install security update from vendor's website.

Vim - update to 9.2.0698
vim (Red Hat package) - addressed in versions 7.4.629-5.el6_10.4, 7.4.629-8.el7_9.2, 8.0.1763-31.el8_10, 8.2.2637-20.el9_2.3, 8.2.2637-20.el9_4.4, 8.2.2637-26.el9_8.13
vim-filesystem - update to 8.0.1763-31.0.1
vim-minimal - update to 8.0.1763-31.0.1
vim-enhanced - update to 8.0.1763-31.0.1
vim-common - update to 8.0.1763-31.0.1
vim-X11 - update to 8.0.1763-31.0.1
vim-common - update to 9.0.2092-38
vim-debuginfo - update to 9.0.2092-38
vim-debugsource - update to 9.0.2092-38
vim-enhanced - update to 9.0.2092-38
vim-minimal - update to 9.0.2092-38
vim-filesystem - update to 9.0.2092-38
vim-X11 - update to 9.0.2092-38
vim - update to 9.0.2092-38
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm30, 2:7.4.1689-3ubuntu1.5+esm36, 2:8.0.1453-1ubuntu1.13+esm21, 2:8.1.2269-1ubuntu5.32+esm9, 2:8.2.3995-1ubuntu2.33, 2:9.1.0016-1ubuntu7.17, 2:9.1.0967-1ubuntu6.8, 2:9.1.2141-1ubuntu4.6
vim (Debian package) - update to 2:9.1.1230-2+deb13u1

• https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4
• https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b

• Out-of-bounds write in Vim
• Ubuntu update for vim
• openEuler update for vim
• Red Hat Enterprise Linux 8 update for vim
• Red Hat Enterprise Linux 9 update for vim
• Anolis OS update for vim
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for vim
• Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION update for vim
• Red Hat Enterprise Linux 9 update for vim
• Red Hat Enterprise Linux 9 update for vim
• Debian update for vim