VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 19, 2021· Updated Nov 3, 2025

Heap-based Buffer Overflow in vim/vim

CVE-2021-3872

Description

A heap-based buffer overflow in Vim's status line rendering function, triggered by an overly long buffer name, could lead to denial of service or arbitrary code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap-based buffer overflow in Vim's status line rendering function, triggered by an overly long buffer name, could lead to denial of service or arbitrary code execution.

Vulnerability

The vulnerability is a heap-based buffer overflow in Vim's status line rendering function, specifically in the win_redr_status function. The root cause is the use of STRCPY without bounds checking when appending buffer status indicators such as "[Help]", "[Preview]", "[+]", or "[RO]". If a buffer name is very long, the status line buffer can be overflown. The issue was introduced prior to Vim 8.2.3487 [3].

Exploitation

An attacker would need to supply a specially crafted long buffer name to Vim, for example by opening a file with an extremely long path or buffer name. The overflow occurs during status line redraw, which can be triggered repeatedly by the user opening such a file, scrolling, or other operations that trigger status line updates. No special network access or authentication is required—local exploitation is sufficient.

Impact

A heap-based buffer overflow can lead to memory corruption, causing Vim to crash (denial of service) and potentially allowing arbitrary code execution in the context of the Vim process. The PR mentions "illegal memory access if buffer name is very long" [3], and the Gentoo advisory [4] describes the worst impact as denial of service.

Mitigation

A fix for Vim 8.2.3487 was committed to the Vim repository on GitHub [3]. Users should upgrade to Vim 8.2.3487 or later. The Gentoo security advisory [4] recommends upgrading to Vim 9.0.0060 or higher. No workaround is available for unpatched versions.

References
  1. patch 8.2.3487: illegal memory access if buffer name is very long · vim/vim@826bfe4
  2. Multiple Vulnerabilities (GLSA 202208-32) — Gentoo security

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

44

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.