Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Not in CISA KEV

CVE-2026-55693 — vim

Fix: vim/vim@a80874d

CVE-2026-55693 is a Out-of-bounds Write vulnerability. A fix is available — see the affected versions and patch details below.

Vim: Out-of-bounds Write in Spell File Word Count

Also known asGHSA-wgh4-64f7-q3jq
Published
Updated
Affected
1 product
Patched
See advisory
Exploits
None indexed
Exploitation data as of Oct 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-55693.

EPSS Exploitation Probability

via FIRST.org ↗
0.1%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs2th percentile — riskier than 2% of all scored CVEsHighest risk
0.00%0.21%0.42%0.63%0.1%0.1%0.1%0.1%0.1%Jul 26Sep 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Description

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.

Affected Products

1 product · 1 configurations
Application
vimvim
< 9.2.0653
range

Detection & mitigation playbook

Vulnerability

  1. Detect

    Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).

  2. Fix

    Upgrade the affected component to the fixed release for CVE-2026-55693, or apply your distribution's backported patch — distro builds are often patched at an older version number, so check your vendor's advisory rather than the upstream version alone.

  3. Workarounds

    Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

This Moderate impact vulnerability in Vim's spell suggestion feature allows an attacker to cause a denial of service. By tricking a user into loading a specially crafted spell file and invoking spell suggestion, an out-of-bounds write can occur, leading to a crash of the editor. This requires user interaction and a…

ProductFixed inAdvisory
Red Hat Enterprise Linux 10vim-2:9.1.083-9.el10_2.12RHSA-2026:48650
Red Hat Enterprise Linux 10.0 Extended Update Supportvim-2:9.1.083-5.el10_0.4RHSA-2026:55431
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONvim-2:7.4.629-5.el6_10.4RHSA-2026:69128
Red Hat Enterprise Linux 7 Extended Lifecycle Supportvim-2:7.4.629-8.el7_9.2RHSA-2026:68711
Red Hat Enterprise Linux 8vim-2:8.0.1763-31.el8_10RHSA-2026:48703
Red Hat Enterprise Linux 9vim-2:8.2.2637-26.el9_8.13RHSA-2026:47982
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsvim-2:8.2.2637-20.el9_2.3RHSA-2026:72466
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutionsvim-2:8.2.2637-20.el9_4.4RHSA-2026:72465
UbuntuHIGH
USN-8500-1Ubuntu

Frequently Asked Questions

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-b
O3 Security · Impact-Aware SCA

Is CVE-2026-55693 in your dependencies?

Find it across , including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-55693: vim Memory Corruption