Out-of-bounds Read in vim/vim
Description
Out-of-bounds read in Vim's delete_buff_tail function when recording in Select mode, leading to crash or memory disclosure.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Out-of-bounds read in Vim's delete_buff_tail function when recording in Select mode, leading to crash or memory disclosure.
Vulnerability
An out-of-bounds read vulnerability exists in the delete_buff_tail function in Vim's buffer handling code. The function fails to check whether buf->bh_curr or buf->bh_curr->b_str is NULL before calling STRLEN, leading to a read from an invalid memory address. This code path is reachable when recording in Select mode. Affected versions are Vim prior to patch 8.2.4233 (i.e., before 8.2.4233). [1]
Exploitation
An attacker can trigger the vulnerability by crafting a sequence of Vim commands that involve recording in Select mode. The attacker needs to be able to execute arbitrary Vim commands, typically by tricking a user into opening a malicious file or executing a macro. No special privileges are required; the user must be using an affected version and perform the specific recording action. [1]
Impact
Successful exploitation results in an out-of-bounds read, which can cause a crash (denial of service) or potentially leak sensitive memory contents. The impact is limited to the Vim process; no remote code execution is indicated in the available references. [1]
Mitigation
The vulnerability is fixed in Vim patch 8.2.4233, released on 2022-01-28. Users should upgrade to Vim 8.2.4233 or later. For distributions, updates are available via package managers (e.g., Gentoo GLSA 202208-32 recommends upgrading to >=9.0.0060). No workaround is known. [1][4]
AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
3Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing NULL-pointer check in delete_buff_tail() allows out-of-bounds read when the buffer header's current entry or its string pointer is NULL."
Attack vector
An attacker can trigger this out-of-bounds read by causing Vim to record typed characters while in Select mode. When recording stops, delete_buff_tail() is called on a buffer header whose bh_curr pointer (or its b_str member) is NULL, and the function calls STRLEN on the NULL pointer without a prior check [ref_id=1]. The crash occurs during normal editing operations when the recording register is finalized, requiring no special privileges beyond the ability to open a file in Vim and enter Select mode.
Affected code
The vulnerable function is delete_buff_tail() in the Vim source, which lacked a NULL check on buf->bh_curr and buf->bh_curr->b_str before calling STRLEN() [ref_id=1]. The patch modifies this function and adds a test function Test_record_in_select_mode.
What the fix does
The patch adds a NULL-pointer guard at the top of delete_buff_tail() that returns early if buf->bh_curr is NULL or buf->bh_curr->b_str is NULL [ref_id=1]. This prevents the subsequent STRLEN() call from dereferencing a NULL pointer. The patch also adds a regression test (Test_record_in_select_mode) that reproduces the crash scenario by recording in Select mode and verifying the output is correct [ref_id=1].
Preconditions
- inputAttacker must be able to cause Vim to enter Select mode and perform a recording operation (q command).
- networkNo network access required; the attack is triggered locally through crafted editor input.
Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/mitrevendor-advisoryx_refsource_FEDORA
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/mitrevendor-advisoryx_refsource_FEDORA
- security.gentoo.org/glsa/202208-32mitrevendor-advisoryx_refsource_GENTOO
- github.com/vim/vim/commit/a4bc2dd7cccf5a4a9f78b58b6f35a45d17164323mitrex_refsource_MISC
- huntr.dev/bounties/ecc8f488-01a0-477f-848f-e30b8e524bbamitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.