VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2021· Updated Aug 3, 2024

Out-of-bounds Read in vim/vim

CVE-2021-4193

Description

An out-of-bounds read vulnerability in Vim could allow an attacker to crash the editor or leak sensitive memory via a crafted file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An out-of-bounds read vulnerability in Vim could allow an attacker to crash the editor or leak sensitive memory via a crafted file.

Vulnerability

CVE-2021-4193 describes an out-of-bounds read vulnerability in Vim, the popular text editor. The bug resides in the in-memory processing of file data when Vim opens a specially crafted file. Affected versions include those prior to the patch released in early 2022; specific version numbers are not detailed in the available references [4]. The issue was reported via huntr.dev and is triggered when a file is opened, requiring no special configuration beyond normal Vim usage [4].

Exploitation

An attacker must convince a user to open a maliciously crafted file with Vim. No network position or authentication is required; only local file access is needed. The sequence involves the attacker providing a crafted file that, when parsed by Vim's internal routines, causes an out-of-bounds read [4]. User interaction is minimal—the victim simply opens the file, and the code path is reachable without additional privileges or race conditions [4].

Impact

Successful exploitation may lead to an unexpected application termination (denial of service) and could potentially leak sensitive memory contents due to the out-of-bounds read [4]. The official description lists this as an out-of-bounds read, indicating a confidentiality impact, though the full extent of information disclosure is not detailed. The impact is limited to the context of the Vim process and does not provide code execution or privilege escalation in typical usage [4].

Mitigation

Vim was patched in the commit that addressed this issue, and users should update to the latest version. As of the available references, no workaround is provided; the only mitigation is to apply the vendor fix. Apple included the fix in macOS Monterey 12.3, macOS Big Sur 11.6.6, and Security Update 2022-005 Catalina, all released by July 2022 [1][2][3]. Systems running unpatched Vim versions are vulnerable and should be updated.

References
  1. About the security content of macOS Monterey 12.3 - Apple Support
  2. About the security content of macOS Big Sur 11.6.6 - Apple Support
  3. About the security content of Security Update 2022-005 Catalina - Apple Support
  4. security - Re: 3 new CVE's in vim

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

44

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing bounds check when a visual position points beyond the end of the line causes an out-of-bounds read in getvcol()."

Attack vector

An attacker can craft a Vim script or input that sets a visual selection (`<C-V>`) on a line and then executes a search for `/\%V` (match within the visual area). If the visual position is invalid (e.g., beyond the end of the line), the old code reads past the NUL terminator, leading to an out-of-bounds read. This can be triggered by running the sequence `0o000\<Esc>0\<C-V>$s0` followed by `/\%V` as shown in the test case [ref_id=1].

Affected code

The bug is in the `getvcol()` function in `src/misc1.c`. When a visual position (`/\%V`) points beyond the end of the line, the old code only checked for an empty line (`*ptr == NUL`) and set `col = 0`, but did not handle the case where `pos->col` is larger than the line length, causing an out-of-bounds read when `ptr + pos->col` is dereferenced.

What the fix does

The patch replaces the single `*ptr == NUL` check with a loop that iterates up to `pos->col` and checks each byte for NUL. If a NUL is found before reaching `pos->col`, it clamps `pos->col` to the current index, preventing the pointer from advancing past the end of the line. This ensures that even when a visual position is invalid, the code stays within the allocated line buffer [ref_id=1].

Preconditions

  • inputThe attacker must be able to supply or trigger a Vim command sequence that sets an invalid visual position and then executes a /\%V search.
  • authThe attacker must have a way to execute Vim commands (e.g., via a crafted file opened in Vim or a plugin).

Generated on May 29, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.