[Security] MacVim affected by CVE-2026-45130 — spell file heap buffer overflow (vim < 9.2.0450)

Inizia in src/spellfile.c, da read_compound(), e confronta la logica di allocazione attuale con il commit upstream di Vim 92993329178cb1f72d700fff45ca86e1c2d369f8. Verifica che il fix per Vim 9.2.0450 sia integrato in MacVim e che l’aritmetica con segno vulnerabile non sia più presente.

[Security] MacVim affected by CVE-2026-45130 — spell file heap buffer overflow (vim < 9.2.0450)

Summary

MacVim bundles the vim source at version 9.2 (patches 1-332 in the current build), which is
below the patched version 9.2.0450 that fixes CVE-2026-45130.

Vulnerability Details

• Upstream CVE: CVE-2026-45130
• Inherited from: vim/vim
• Affected code: src/spellfile.c, function read_compound()
• Vulnerability type: CWE-122 — Heap-Based Buffer Overflow
• Fixed in: vim 9.2.0450 (commit 92993329178cb1f72d700fff45ca86e1c2d369f8)

Root Cause

In read_compound() in src/spellfile.c, the buffer size for the compound pattern is
computed as:

int c;
int todo = len;   // len is the 4-byte section length from the .spl file
c = todo * 2 + 7;
if (enc_utf8)
    c += todo * 2;  // total: todo * 4 + 7
pat = alloc(c);

When enc_utf8 is active, todo * 4 + 7 is computed using signed 32-bit arithmetic.
For certain values of len (e.g., 0x40000002), the multiplication overflows the signed
32-bit integer, producing a small positive c. The subsequent alloc(c) returns an
undersized buffer. The loop that follows then writes up to todo * 4 bytes into this
tiny buffer, causing a heap-based buffer overflow.

The fix (commit 92993329) changes the computation to use size_t arithmetic:

size_t patsize = (size_t)todo * 2 + 7;
patsize += (size_t)todo * 2;

Affected MacVim Code

MacVim's src/spellfile.c (merged from vim/vim) contains the vulnerable code:

// src/spellfile.c around line 1278 (macvim r183)
c = todo * 2 + 7;
if (enc_utf8)
    c += todo * 2;
pat = alloc(c);

Affected MacVim Version

MacVim r183 (vim 9.2 patches 1-332) — current HEAD as of 2026-05-18.

The fix commit 92993329178cb1f72d700fff45ca86e1c2d369f8 from vim/vim is not present
in the macvim-dev/macvim repository:

git log --all --oneline | grep 92993329  # returns no output

Suggested Fix

Merge or cherry-pick vim/vim patches up to at least 9.2.0450:

• Upstream fix: https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8

References

• CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-45130
• Upstream fix commit: https://github.com/vim/vim/commit/92993329178cb1f72d700fff45ca86e1c2d369f8