High [CVE-2026-73072] Heap buffer overflow allows arbitrary code execution
This high-severity Red Hat Linux advisory covers CVE-2026-73072 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation.
This issue is fixed in version 9.2.0846. A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code.
The flaw is triggered by processing a specially crafted spell file, where the set_sofo() function fails to reset internal data between sections, leading to an out-of-bounds write. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
Red Hat lists Red Hat Hardened Images; Red Hat OpenShift Container Platform 4 as not affected. Red Hat fixing advisory: RHSA-2026:66336, RHSA-2026:66348, RHSA-2026:66366.
Affected products named by the advisory: Red Hat package: vim.
- < 9.2.0846
Official advisory · high-confidence parse· fetched 20 days ago·verify at source
- 9.2.0846
- vim-2:9.1.083-9.el10_2.20
- vim-2:8.0.1763-31.el8_10.7
- vim-2:8.2.2637-26.el9_8.21
- RHSA-2026:66336
- RHSA-2026:66348
- RHSA-2026:66366
Official advisory · high-confidence parse· fetched 20 days ago·verify at source
Mitigation checklist
- If spell checking is unused, disable it with set nospell in ~/.vimrc and do not set spelllang. If spell is required, load only trusted .spl files from Vim’s spell directories and do not place untrusted spell files on runtimepath. Additionally, consider disabling modelines (set nomodeline in ~/.vimrc) to prevent untrusted text files from automatically overriding these settings when opened.
Official advisory · high-confidence parse· fetched 20 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.