CVE-2026-59857: vim Out-of-bounds Write

Vulnerability summary

CVE-2026-59857 is a medium (CVSS 5.6) Out-of-bounds Write vulnerability in vim. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.1% of scored vulnerabilities.

Timeline

1. 09-07-2026
   PublishedVulnerability first disclosed.
2. 10-07-2026
   Last modifiedVulnerability information updated.

Description

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.