{"id":"AZL-91113","summary":"CVE-2026-55892 affecting package vim for versions less than 9.2.0735-1","details":"Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.","modified":"2026-08-28T17:48:11.946606872Z","published":"2026-06-25T16:16:40Z","upstream":["CVE-2026-55892"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55892"}],"affected":[{"package":{"name":"vim","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/vim"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0735-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91113.json"}}],"schema_version":"1.9.0"}