{"id":"AZL-91107","summary":"CVE-2026-55693 affecting package vim for versions less than 9.2.0735-1","details":"Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.","modified":"2026-08-28T17:47:46.449777162Z","published":"2026-06-25T16:16:40Z","upstream":["CVE-2026-55693"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55693"}],"affected":[{"package":{"name":"vim","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/vim"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0735-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91107.json"}}],"schema_version":"1.9.0"}