Description
Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vim | vim | < 9.2.0698 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 2:9.2.0782-1 | — |
| Debian 13 | vim | 2:9.1.1230-2+deb13u1 | — |
| Debian 12 | vim | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | vim | 2:9.1.2141-1ubuntu4.6 | USN-8500-1 |
| Ubuntu 25.10 | vim | 2:9.1.0967-1ubuntu6.8 | USN-8500-1 |
| Ubuntu 24.04 LTS | vim | 2:9.1.0016-1ubuntu7.17 | USN-8500-1 |
| Ubuntu 22.04 LTS | vim | 2:8.2.3995-1ubuntu2.33 | USN-8500-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | vim | 2:8.1.2269-1ubuntu5.32+esm9 | USN-8500-1 |
| Ubuntu Pro 18.04 LTS | vim | 2:8.0.1453-1ubuntu1.13+esm21 | USN-8500-1 |
| Ubuntu Pro 16.04 LTS | vim | 2:7.4.1689-3ubuntu1.5+esm36 | USN-8500-1 |
| Ubuntu Pro 14.04 LTS | vim | 2:7.4.052-1ubuntu3.1+esm30 | USN-8500-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | vim +3 | 2:9.1.083-9.el10_2.12 | RHSA-2026:48650 |
| RHEL 9 | vim +3 | 2:8.2.2637-26.el9_8.13 | RHSA-2026:47982 |
| RHEL 8 | vim +3 | 2:8.0.1763-31.el8_10 | RHSA-2026:48703 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | vim +3 | 2:9.1.083-5.el10_0.4 | RHSA-2026:55431 |
| RHEL 9.6 EUS | vim +5 | 2:8.2.2637-22.el9_6.4 | RHSA-2026:70818 |
| RHEL 9.4 E4S | vim +5 | 2:8.2.2637-20.el9_4.4 | RHSA-2026:72465 |
| RHEL 9.2 E4S | vim +5 | 2:8.2.2637-20.el9_2.3 | RHSA-2026:72466 |
| RHEL 7 ELS | vim +4 | 2:7.4.629-8.el7_9.2 | RHSA-2026:68711 |
| RHEL 6 ELS | vim +4 | 2:7.4.629-5.el6_10.4 | RHSA-2026:69128 |
| Red Hat Hardened Images 1 | vim +8 | 9.2.725-1.hum1 | RHSA-2026:30267 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | xxd +6 | 2:9.1.083-9.el10_2.12 | ALSA-2026:48650 |
| AlmaLinux 9 | vim-X11 +4 | 2:8.2.2637-26.el9_8.13 | ALSA-2026:47982 |
| AlmaLinux 8 | vim-X11 +4 | 2:8.0.1763-31.el8_10 | ALSA-2026:48703 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | vim | 2:9.1.083-9.el10_2.12 | RLSA-2026:48650 |
| Rocky Linux 9 | vim | 2:8.2.2637-26.el9_8.13 | RLSA-2026:47982 |
| Rocky Linux 8 | vim | 2:8.0.1763-31.el8_10 | RLSA-2026:48703 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | vim | 9.2.0699-r0 | — |
| Alpine v3.23 | vim | 9.2.0854-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | xxd +6 | 2:9.2.725-1.amzn2023.0.1 | ALAS2023-2026-1940 |
| Amazon Linux 2 | xxd +6 | 2:9.0.2153-1.amzn2.0.11 | ALAS2-2026-3883 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | vim | 9.2.0735-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | xxd +6 | 2:9.1.083-9.0.1.el10_2.12 | ELSA-2026-48650 |
| Oracle Linux 9 | vim-X11 +4 | 2:8.2.2637-26.0.1.el9_8.13 | ELSA-2026-47982 |
| Oracle Linux 8 | vim-X11 +4 | 2:8.0.1763-31.0.1.el8_10 | ELSA-2026-48703 |
Advisories 24
- WID-SEC-2026-2026 vim: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 1, 2026
- ALSA-2026:47982 Important: vim security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:48650 Important: vim security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:48703 Important: vim security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:69128 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:72466 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:72465 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:70818 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:68711 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:55431 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:48703 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:48650 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:47982 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:30267 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2026-3043 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- ALAS2-2026-3883 Important: vim security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 31, 2026
- RLSA-2026:48650 Important: vim security update Rocky Linux Security Advisories · Aug 1, 2026
- RLSA-2026:48703 Important: vim security update Rocky Linux Security Advisories · Jul 31, 2026
- RLSA-2026:47982 Important: vim security update Rocky Linux Security Advisories · Jul 30, 2026
- ELSA-2026-48703 Important: vim security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 30, 2026
- ELSA-2026-48650 Important: vim security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 30, 2026
- ELSA-2026-47982 Important: vim security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 30, 2026
- ALAS2023-2026-1940 Important: vim security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026
- USN-8500-1 vim vulnerabilities Ubuntu Security Notices (USN) · Jul 2, 2026