CVE-2026-59857: 
Vim vulnerability analysis and mitigation

CVE-2026-59857 is a stack out-of-bounds write vulnerability in Vim's spell_soundfold_sal() function, classified as "Out-of-bounds Write in SAL Soundfolding." It affects all Vim versions prior to 9.2.0725 and was disclosed on June 24, 2026, with the CVE published on July 9, 2026. The vulnerability allows a local user to crash the editor by corrupting the eval_soundfold() stack frame. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 5.6 (Medium) (GitHub Advisory, Red Hat).

The root cause is an off-by-one out-of-bounds write (CWE-787) in the single-byte branch of spell_soundfold_sal() in src/spell.c. The result buffer res is a stack array of size MAXWLEN (254 bytes, valid indices 0–253), but writes are guarded with reslen < MAXWLEN rather than reslen < MAXWLEN - 1, allowing reslen to reach 254. The subsequent null-terminator write res[reslen] = NUL then writes one byte past the end of the buffer. This vulnerable branch is only reachable under a non-multibyte 8-bit encoding (e.g., set encoding=latin1); the default UTF-8 path uses a different, unaffected branch. Exploitation requires spell checking to be enabled with a SAL-based language and soundfold() to be invoked on a boundary-length (~253-character) word, either directly or via sound-based spell suggestions (GitHub Advisory, Vim Commit).

Successful exploitation causes a stack frame corruption in eval_soundfold(), resulting in an editor crash (denial of service). There is no confidentiality or integrity impact — the CVSS scoring reflects availability impact only. The vulnerability is constrained to local attack scenarios requiring user interaction, limiting its scope to the affected Vim process without potential for lateral movement or data exfiltration (GitHub Advisory, Red Hat Bugzilla).

1. Precondition – Configure Vim for a vulnerable encoding: Open Vim and set a non-multibyte 8-bit encoding, e.g., :set encoding=latin1, to ensure the vulnerable single-byte branch of spell_soundfold_sal() is taken.
2. Precondition – Enable SAL-based spell checking: Load a spell language that uses SAL sound-folding rules (e.g., a custom .aff file with SAL collapse_result false and non-collapsing SAL mappings), then enable spell checking: :set spell spl=Xsal.latin1.spl.
3. Trigger the overflow: Call soundfold() with a boundary-length word of approximately 253 characters, e.g., :echo soundfold(repeat('a', 253)). This drives reslen to MAXWLEN (254) and causes the null-terminator write to go one byte past the end of the stack buffer.
4. Result: The eval_soundfold() stack frame is corrupted, causing the Vim process to abort/crash (GitHub Advisory, Vim Commit).

• Process: Unexpected Vim process crash or abort signal (SIGABRT/SIGSEGV) when spell checking or soundfold() is invoked under a non-UTF-8 encoding.
• Logs: System crash logs or core dumps referencing spell_soundfold_sal() or eval_soundfold() stack frames in Vim.
• File System: Presence of custom .aff spell files with SAL collapse_result false and non-collapsing SAL rules, or unusual .spl spell files in Vim runtime paths.
• Vim Scripts: Vim scripts or plugins invoking soundfold() on long (≥253-character) strings while encoding=latin1 or another 8-bit encoding is active (GitHub Advisory).

Upgrade Vim to version 9.2.0725 or later, which bounds all single-byte SAL result writes and the terminating NUL to MAXWLEN - 1, eliminating the off-by-one write. As a temporary workaround, avoid using spell checking with SAL-based spell languages under non-multibyte 8-bit encodings (e.g., do not use set encoding=latin1 with spell checking enabled), or disable sound-based spell suggestion features until the patch is applied. Ubuntu has issued security notice USN-8541-1, and openSUSE/SUSE have released corresponding updates (Vim Commit, Red Hat, Ubuntu Advisory).

The vulnerability was reported and analyzed by Hirohito Higashi (@h-east), who also suggested the fix; the Vim project acknowledged the contribution in the security advisory. The issue was noted as the SAL counterpart to a previously fixed SOFO branch vulnerability (GHSA-q8mh-6qm3-25g4, fixed in 9.2.0698), discovered during a code audit of the surrounding spell-checking code. No significant broader media coverage or social media discussion beyond standard CVE tracking feeds has been observed (GitHub Advisory, Vim Commit).