CVE-2026-73072

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0846

Description The set sofo() function in src/spellfile.c reuses the sl sal first[] array without resetting values previously set by set sal first(). A specially crafted spell file containing an SN SAL section before an SN SOFO section can lead to under-counted mapping lists and allow attacker-influenced writes beyond a heap allocation, which is a memory corruption issue where data is written outside the boundaries of a pre-allocated memory block on the heap.

Recommendations Update to version 9.2.0846.