Heap Buffer Overflow in Vim spell file loading

CVE-2026-45130 is a heap-based buffer overflow in Vim prior to 9.2.0450 in the spell file parsing logic, specifically read_compound() in src/spellfile.c. When Vim loads a crafted .spl spell file with UTF-8 encoding active, an attacker-controlled length field in the compound section is used in integer arithmetic on 32-bit signed int variables (including calculations such as todo * 2 + 7, with an additional todo * 2 in the UTF-8 path). This can overflow and wrap the computed allocation size to a small positive value, causing Vim to allocate an undersized heap buffer and then write beyond it in a loop that iterates based on the attacker-controlled length. The result is heap corruption during spell file loading. The issue is reachable when a malicious spell file is present on the runtimepath and Vim is induced to load it, including via spell checking for the matching language or a modeline that sets spelllang.