CVE-2026-73072

HighCVSS 7.3/10Last modified Oct 6, 2026

Description

Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

Vendor	Product	Versions
vim	vim	< 9.2.0846

References

https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66aPatch
https://github.com/vim/vim/releases/tag/v9.2.0846Product
https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64Patch, Vendor Advisory

Timeline

Published: Aug 11, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-730737.8Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and execute CVE-2026-730746.7Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_pr CVE-2026-730753.9Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negat CVE-2026-730767.8Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .Vimb CVE-2026-730777.8Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplu CVE-2026-730788.8Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/net CVE-2026-730798.5Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, CVE-2026-73085.4An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the bro CVE-2026-730809.3SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a ca CVE-2026-730818.7Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk p CVE-2026-730825.3Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-ag CVE-2026-730837.6Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled us