CVE-2026-73072

This CVE is a state-confusion bug in Vim's spell file parser where section processing order becomes the attack vector. The vulnerability works in two phases: the SN_SAL section handler populates `sl_sal_first[]` with values during its processing, and then SN_SOFO's handler reuses that same array without resetting it. This shared-state inheritance lets an attacker plant values during the first phase that corrupt `set_sofo()`'s allocation sizing logic in the second phase — the result isn't just a crash, it's an attacker-controlled write beyond heap boundaries. The critical point that gets undersold: this is an arbitrary write primitive, not merely a denial of service. The CVSS 8.5 reflects the technical difficulty of reliable exploitation, but the real danger is the primitive itself. The payload is the file structure — weaponizing section order rather than injecting code means traditional exploit countermeasures may not detect it. More concerning than single-machine exploitation is the distribution model. Spell files (.spl) are routinely shared through dotfile repositories, plugin managers, and team configurations. Vim loads them automatically when detecting a spell-checked filetype. The attack requires only that a victim open or auto-load a malicious spell file — no explicit user action, no scripting. This makes the blast radius significantly larger than the CVSS metric captures. The fix in 9.2.0846 resets `sl_sal_first[]` between phases, which is correct but narrow. The deeper architectural problem is that multiple section handlers in the spell file parser appear to share mutable state without clear ownership semantics. Any new section handler added to that file inherits this implicit contract. Audit other handlers in spell.c for similar state-sharing patterns — this fix closes one vector but the architecture that enabled it remains.

Reviewed through automated stages and approved by a human before publication.