CVE-2026-55693

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0653

Description The tree count words() function in src/spellfile.c fails to validate a depth counter against the size of fixed MAXWLEN-element stack arrays, specifically arridx[], curi[], and wordcount[]. A specially crafted .spl/.sug file pair can trigger an arbitrarily deep descent during spell suggestion, resulting in a stack out-of-bounds write. This memory corruption affects the call frame and leads to an application crash.

Recommendations Update to version 9.2.0653.