Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-08 | 1 | Disclosure1 |
| 2026-05-09 | 1 | Disclosure1 |
| 2026-05-10 | 1 | General1 |
CVE-2026-45130 Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted… https://www.cve.org/CVERecord?id=CVE-2026-45130
Post summary
The snippet discloses a heap buffer overflow vulnerability in Vim prior to version 9.2.0450, detailing the affected function but offering no PoC, exploitation evidence, or mitigation information.
Devs Palace ERP CVE-2026-8218–8221 Vim heap RCE CVE-2026-45130 Lynx RaaS posts 8 victims FulcrumSec lists 7–12TB Avnet MacSync via http://Claude.ai chats Full brief: https://intel.overresearched.net/2026/05/10/cti-daily-brief/ #Daily #ThreatIntel #InfoSec
Post summary
The tweet offers a brief summary of several CVEs and related incidents but lacks actionable details, exploitation evidence, or patch information.
CVE-2026-45130 Heap Buffer Overflow in Vim Prior to Version 9.2.0450 via Crafted Spell File https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45130
Post summary
The post announces CVE-2026-45130 as a heap buffer overflow in Vim before 9.2.0450 caused by crafted spell files, but it offers no proof‑of‑concept, exploit details, or patch information.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | neovim | neovim | - | - | - |
| App | vim | vim | - | - | - |