CVE-2026-45130

A flaw was found in Vim, an open-source command-line text editor. A heap buffer overflow exists in the read_compound() function when processing a specially crafted spell file (.spl) with UTF-8 encoding active. A remote attacker could exploit this by convincing a user to open a text file containing a malicious modeline, which could then load a planted malicious spell file. This could lead to a heap overflow, potentially resulting in an application-level denial of service.

This Moderate flaw in Vim arises from a heap buffer overflow when processing specially crafted spell files with UTF-8 encoding. Exploitation requires user interaction, specifically opening a text file containing a malicious modeline that points to a planted, malicious spell file. This limits the attack vector to scenarios where an attacker can control both the text file and the spell file on the user's system, leading primarily to application-level denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.