Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.
{
"cwe_ids": [
"CWE-122",
"CWE-190"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45130.json"
}{
"source": [
"AFFECTED_FIELD",
"CPE_RANGE",
"REFERENCES"
],
"cpe": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "9.2.0450"
}
]
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45130.json"
[
{
"source": "https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "198880610507712377716544680363170717278",
"length": 2697.0
},
"id": "CVE-2026-45130-7d46ae12",
"target": {
"function": "read_compound",
"file": "src/spellfile.c"
},
"deprecated": false
},
{
"source": "https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"214745478425721947372787556684998181732",
"307552842425584218756154484154866389114",
"180398815292590562023222901274050262576"
],
"threshold": 0.9
},
"id": "CVE-2026-45130-a02fe6cf",
"target": {
"file": "src/version.c"
},
"deprecated": false
},
{
"source": "https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"44621093723896354027239434254089684728",
"319103138312409049089361621625587137289",
"286716464778697862373331296685932530949",
"306141185181930134214413198026740057494",
"29591709560059476389136775570292079096",
"112315654542105948669099686543890864509",
"339986975843774665330510953994019782263",
"219441026866576440041213748594378101367",
"197277380716057870211578206697353593897",
"55291341627936384695022410650671528133",
"102081954251235561628500689485692038269",
"237871992140894378570000808123516314182",
"206594948125010500869017728903572765049",
"138455659168041765006575420057327961869",
"91230530544890066081011827838864568088",
"254510795012023271083662692523367846100",
"181155176083536686876013237877548137024",
"230077687303066689255642875712086936557",
"321213190060126554805734023168999901642",
"4582515304924986262148543240286728896",
"49967788084216863893152731239848876767",
"209645492099409785536831001808979283981",
"28978298769014861781888763724913819862",
"290139825068683136542267968116127986517",
"217375719741514013023724736149125747679"
],
"threshold": 0.9
},
"id": "CVE-2026-45130-a8ff6f46",
"target": {
"file": "src/spellfile.c"
},
"deprecated": false
}
]
"2026-08-05T08:33:28Z"