CVE-2026-55892— Vim 缓冲区错误漏洞
Possible ATT&CK Techniques 1AI
T1203 · Exploitation for Client Execution新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-55892の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Vim: Out-of-bounds Write in Spell File Prefix Dump
ソース: NVD (National Vulnerability Database)
脆弱性説明
Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
跨界内存写
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Vim 缓冲区错误漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Vim是Vim组织开源的一款跨平台的文本编辑器。 Vim 9.2.0662之前版本存在缓冲区错误漏洞，该漏洞源于dump_prefixes()函数在遍历拼写文件前缀树时，深度计数器仅受树结构自身限制，未检查固定大小栈数组的索引边界，导致栈越界写入，可能破坏调用帧并导致编辑器崩溃。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-55892の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-55892のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-55892 补丁与修复 (2)
- 🔗 Release v9.2.0662 · vim/vim · GitHubx_refsource_MISC
CVE-2026-55892 厂商安全公告 (1)
Same Patch Batch · vim · 2026-06-25 · 9 CVEs total
| CVE-2026-57453 | 6.5 MEDIUM | Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction |
| CVE-2026-57452 | 5.5 MEDIUM | Vim: Out-of-bounds Read with libsodium-encrypted Files |
| CVE-2026-57451 | 5.3 MEDIUM | Vim: Out-of-bounds Read in Text Property Count |
| CVE-2026-57456 | Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings | |
| CVE-2026-57455 | Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold() | |
| CVE-2026-57454 | Vim: Out-of-bounds Read with Text Properties | |
| CVE-2026-55895 | Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename | |
| CVE-2026-55693 | Vim: Out-of-bounds Write in Spell File Word Count |
IV. 関連脆弱性
同じ製品: vim
- CVE-2026-55693
Vim: Out-of-bounds Write in Spell File Word Count - CVE-2026-55895
Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() vi - CVE-2026-57451
Vim: Out-of-bounds Read in Text Property Count - CVE-2026-57452
Vim: Out-of-bounds Read with libsodium-encrypted Files - CVE-2026-57453
Vim: PowerShell Command Injection via Unescaped Filename in
同じベンダー: vim
- CVE-2026-55693
Vim: Out-of-bounds Write in Spell File Word Count - CVE-2026-55895
Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() vi - CVE-2026-57451
Vim: Out-of-bounds Read in Text Property Count - CVE-2026-57452
Vim: Out-of-bounds Read with libsodium-encrypted Files - CVE-2026-57453
Vim: PowerShell Command Injection via Unescaped Filename in
同じ弱点: CWE-787
- CVE-2026-14612
Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in i - CVE-2026-13053
WatchGuard Firebox Authenticated Out of Bounds Write in Mana - CVE-2026-13050
WatchGuard Firebox networkd Out of Bounds Write Vulnerabilit - CVE-2026-13384
WatchGuard Firebox wgagent Out of Bounds Write Vulnerability - CVE-2026-13383
WatchGuard Firebox ikestubd Out of Bounds Write Vulnerabilit
V. CVE-2026-55892へのコメント
まだコメントはありません