Vim: Out-of-bounds Write in Spell File Word Count

Description

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.

Scores

EPSS (exploitation in 30 days)

0.12% · top 98% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.7.

Weakness

• CWE-787: Out-of-bounds Write (opens in a new tab)All about CWE-787 and its CVEs

Affected products

• vim · vim

  • affected < 9.2.0653

References (3)

• https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq (opens in a new tab)x_refsource_CONFIRM
• https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7 (opens in a new tab)x_refsource_MISC
• https://github.com/vim/vim/releases/tag/v9.2.0653 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-55693](https://trackcve.app/badge/CVE-2026-55693.svg)](https://trackcve.app/cve/CVE-2026-55693)

Record last updated 26 Jun 2026, 14:03 UTC.