CVE-2026-59857— Vim 缓冲区错误漏洞

Vim: Out-of-bounds Write in SAL Soundfolding

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen < MAXWLEN, allowing reslen to reach MAXWLEN before res[reslen] = NUL writes one byte past the end of the MAXWLEN-element stack buffer. A boundary-length word passed to soundfold(), or reached via sound-based spell suggestion while a SAL-based spell language is active under a non-multibyte 8-bit encoding, can corrupt the eval_soundfold() stack frame and crash the editor. This issue is fixed in version 9.2.0725.

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

跨界内存写

Vim 缓冲区错误漏洞

Vim是Vim组织开源的一款跨平台的文本编辑器。 Vim 9.2.0725之前版本存在缓冲区错误漏洞，该漏洞源于src/spell.c文件中的spell_soundfold_sal()函数单字节分支存在越界写入问题，可能破坏eval_soundfold()堆栈帧并导致编辑器崩溃。

N/A

N/A