CVE-2026-55892

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0662

Description The dump prefixes() function in src/spell.c iteratively walks a spell-file prefix trie using a depth counter to dump prefixes applying to a word. Because the counter is not checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], and curi[]), a specially crafted .spl file can cause the descent to go arbitrarily deep. This results in a stack out-of-bounds write, which corrupts the call frame and causes the editor to crash.

Recommendations Update to version 9.2.0662.