Vim fixes spell file parser flaws that can crash editors via malicious `.spl` files

Vim disclosed and patched multiple medium-severity memory-safety vulnerabilities in its spell file parser that can be triggered by a crafted .spl spell file placed on the runtimepath. The first issue, tracked as CVE-2026-45130, affects Vim versions earlier than 9.2.0450 and stems from an integer overflow in read_compound() in src/spellfile.c when UTF-8 spell data is loaded. A malicious SN_COMPOUND length can cause an undersized heap allocation followed by out-of-bounds writes, leading primarily to a crash when a user enables spell checking or opens a file whose modeline sets spelllang and spell; Vim noted denial of service as the practical impact, though the advisory said code execution might be possible in some conditions. Daniel Cervera of Microsoft Security Engineering reported the flaw, and Vim fixed it by adding stricter bounds checks and safer allocation handling in patch 9.2.0450.

Vim later disclosed three additional spell parser bugs affecting versions earlier than 9.2.0513: a heap out-of-bounds read caused by uninitialized shared-node targets, a one-byte heap out-of-bounds read in word-counting logic, and a stack overflow from uncontrolled recursion in read_tree_node(). As with the earlier bug, exploitation requires a malicious spell file on the runtimepath and user-triggered spell loading, including via modelines. Vim rated the newer issues Medium severity and said the likely outcome is editor crashes and limited unintended reads of adjacent or uninitialized heap data rather than reliable code execution, underscoring ongoing risk in the application's spell file parsing path.