CVE-2026-59857

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0725

Description A flaw exists in the single-byte branch of the spell soundfold sal() function within src/spell.c. When translating a word using a spell file's SAL sound-folding rules into a caller-owned result buffer, the process is guarded by reslen < MAXWLEN. This allows reslen to reach MAXWLEN, causing the subsequent res[reslen] = NUL operation to write one byte beyond the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold() or encountered during sound-based spell suggestions while a SAL-based spell language is active under a non-multibyte 8-bit encoding can corrupt the eval soundfold() stack frame, leading to an editor crash.

Recommendations Update to version 9.2.0725.