DEBIAN-CVE-2026-55892

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-55892
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55892.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-55892
Upstream
Published
2026-06-25T16:16:40Z
Modified
2026-09-01T16:06:51Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.

References

Affected packages

Debian:12 / vim

Package

Name
vim
Purl
pkg:deb/debian/vim?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2:9.*
2:9.0.1378-2
2:9.0.1378-2+deb12u1
2:9.0.1378-2+deb12u2
2:9.0.1658-1
2:9.0.1672-1
2:9.0.1894-1
2:9.0.2018-1
2:9.0.2087-1
2:9.0.2103-1
2:9.0.2116-1
2:9.0.2189-1
2:9.1.0-1
2:9.1.0016-1
2:9.1.0199-1
2:9.1.0374-1
2:9.1.0377-1
2:9.1.0496-1
2:9.1.0698-1
2:9.1.0709-1
2:9.1.0709-2
2:9.1.0777-1
2:9.1.0861-1
2:9.1.0967-1
2:9.1.0967-2
2:9.1.1113-1
2:9.1.1230-1
2:9.1.1230-2
2:9.1.1385-1
2:9.1.1766-1
2:9.1.1829-1
2:9.1.1846-1
2:9.1.1882-1
2:9.1.2103-1
2:9.1.2141-1
2:9.2.0119-1
2:9.2.0136-1
2:9.2.0218-1
2:9.2.0315-1
2:9.2.0338-1
2:9.2.0355-1
2:9.2.0428-1
2:9.2.0461-1
2:9.2.0524-1
2:9.2.0782-1
2:9.2.0858-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55892.json"

Debian:13 / vim

Package

Name
vim
Purl
pkg:deb/debian/vim?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2:9.*
2:9.1.1230-2
2:9.1.1385-1
2:9.1.1766-1
2:9.1.1829-1
2:9.1.1846-1
2:9.1.1882-1
2:9.1.2103-1
2:9.1.2141-1
2:9.2.0119-1
2:9.2.0136-1
2:9.2.0218-1
2:9.2.0315-1
2:9.2.0338-1
2:9.2.0355-1
2:9.2.0428-1
2:9.2.0461-1
2:9.2.0524-1
2:9.2.0782-1
2:9.2.0858-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55892.json"

Debian:14 / vim

Package

Name
vim
Purl
pkg:deb/debian/vim?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2:9.2.0782-1

Affected versions

2:9.*
2:9.1.1230-2
2:9.1.1385-1
2:9.1.1766-1
2:9.1.1829-1
2:9.1.1846-1
2:9.1.1882-1
2:9.1.2103-1
2:9.1.2141-1
2:9.2.0119-1
2:9.2.0136-1
2:9.2.0218-1
2:9.2.0315-1
2:9.2.0338-1
2:9.2.0355-1
2:9.2.0428-1
2:9.2.0461-1
2:9.2.0524-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55892.json"