CVE-2026-73072 is a heap buffer overflow in Vim. The spell file loader reuses an index table without resetting it, so a crafted spell file causes a write past the end of a heap buffer. The record scores it 7.3, High. Vim 9.2.0846 fixes it, so upgrade to that patch level or later.
What's affected
The record and the advisory both say Vim before 9.2.0846 is affected, and that 9.2.0846 is the fixed patch level. The flaw sits in set_sofo() in src/spellfile.c.
The advisory explains the mechanism at a high level. A spell file can hold a sound folding section and a simple character mapping section that do the same job. Reading the first fills an index table. Reading the second uses that table to count mappings but does not reset it, so every count is one too low. The buffer sized from that count is too small, and the extra data is written past its end. Vim loads a spell file when a language is picked with the spelllang option, and the loader does not require sections in any order.
The weakness classes are CWE-122, heap based buffer overflow, and CWE-787, out of bounds write.
How to check if you're exposed
Check the patch level of every Vim you run, including copies on servers, jump hosts and developer machines.
vim --version | head -3
vim --version | grep 'Included patches'
The second line prints a range such as 1 to a four digit number. The version is safe for this issue if that number is at least the fixed patch level. Linux distributions often backport fixes without changing the upstream patch number, so also check your distribution's security notes for the package. Vim is often installed by default on servers, in container base images and in CI images, so scan image contents too. The free in-browser scan at gold.safeguard.sh/scan can check a manifest for known CVEs.
Then think about where Vim might load a spell file you did not write. That happens when a user sets a language for spell checking from a file that came from outside, such as a downloaded spell file or a file shipped inside a project.
What to do now
- Upgrade Vim to patch level 9.2.0846 or later, or install your distribution's fixed package.
- Do not load spell files from untrusted sources until you are patched.
- Update container base images and CI images that include Vim, then rebuild.
- Remove Vim from minimal images that do not need an editor.
- Check developer machines through your usual software inventory.
- Record the patch level you now run so the next review is quick.
Why it matters
Memory writes past the end of a buffer are one of the oldest classes of bug, and file parsers are a common home for them. Here the bug comes from state that survives between two sections of a file. The code assumes an order of sections that the file format does not enforce, and a file that breaks the assumption produces a short buffer.
The sources differ on severity. The record scores it 7.3 under CVSS 3.1 and rates it High. The Vim GitHub advisory labels it Moderate and its text says Medium. Local attack vectors and a need for user action are the reason the project rates it lower. Plan around your own use. A shared jump host where many people open files from others is a bigger risk than a single user laptop. No source reports exploitation in the wild, and the CVE is not in the CISA KEV catalog. For this CVE, the user must open a file and take an action, which limits who is at risk to people who handle spell files from others.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
How does a crafted spell file cause harm?
The loader undercounts a table when two related sections appear in a certain order, so a buffer is too small and data is written past its end.
Which patch level fixes CVE-2026-73072?
Vim 9.2.0846.
Sources
Last reviewed: 18 October 2026.
