CVE-2026-73072 vim CVE debrief

Who should care

Defenders responsible for maintaining and updating Vim installations should prioritize updating to version 9.2.0846 or later to prevent potential attacks. This includes operators, platform administrators, vulnerability management teams, and security teams. They should review and update vulnerable systems, monitor for potential attacks, and verify affected Vim installations. The vulnerability has a high severity and defenders should take immediate action to

Why it matters

CVE-2026-73072 is a high-severity vulnerability in Vim that can allow an attacker to write beyond a heap allocation. Defenders should prioritize updating Vim to version 9.2.0846 or later to prevent potential attacks.

• Potential attacker-influenced writes beyond a heap allocation
• Under-counted mapping lists in the set_sofo() function

Technical summary

The vulnerability exists in the set_sofo() function in src/spellfile.c, where it reuses sl_sal_first[] without resetting values left by set_sal_first(). This can cause under-counted mapping lists and allow an attacker to write beyond a heap allocation. The issue is fixed in version 9.2.0846. The vulnerability has a high severity and defenders should prioritize updating Vim to the fixed version. The CVE record was published on 2026-08-11T16:17:38.553Z and has not been modified since then. Affected product deployments should be reviewed and updated to prevent potential attacks.

Defensive priority

Defenders should prioritize updating Vim to version 9.2.0846 or later to prevent potential attacks.

Recommended defensive actions

• Update Vim to version 9.2.0846 or later
• Review and update vulnerable systems
• Monitor for potential attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by the improper reuse of sl_sal_first[] in the set_sofo() function. This can lead to under-counted mapping lists and allow an attacker to write beyond a heap allocation. The issue is fixed in version 9.2.0846. Defenders should verify affected Vim installations and update to the fixed version. The CVE record was published on 2026-08-11T16:17:38.553Z and has not been modified since then. Evidence limits suggest that further verification may be required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.