Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo() in src/spellfile.c reuses slsalfirst[] without resetting values left by setsalfirst(), so a crafted spell file containing an SNSAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.
{
"cwe_ids": [
"CWE-122",
"CWE-787"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73072.json",
"cna_assigner": "GitHub_M"
}[
{
"source": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a",
"deprecated": false,
"id": "CVE-2026-73072-a1e650ba",
"target": {
"file": "src/version.c"
},
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"295173160872893591094729078698599477016",
"124224203405085603356616932528769045706",
"104448407832713388715765983861699651544"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-73072-c76df129",
"target": {
"file": "src/spellfile.c",
"function": "set_sofo"
},
"source": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a",
"signature_type": "Function",
"digest": {
"function_hash": "106420161514852654257428342410145520503",
"length": 1593.0
}
},
{
"target": {
"file": "src/spellfile.c"
},
"deprecated": false,
"id": "CVE-2026-73072-e65703c8",
"signature_version": "v1",
"digest": {
"line_hashes": [
"61670644432439125315075087407546525233",
"167760905723313777122314692499532126204",
"158857340716644200504376814011552507636"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73072.json"
"2026-08-15T16:52:32Z"