Stack-based Buffer Overflow in vim/vim

Vulnerability

A stack-based buffer overflow exists in the spell suggestion functionality of Vim, specifically in the suggest_trie_walk and suggest_try_change functions. The vulnerability arises because the code does not properly check the stack depth (depth < MAXWLEN) before accessing the stack array, allowing a deep recursion to write past the allocated stack buffer. This affects Vim versions prior to 8.2 (fixed in patch 8.2.4247). [1]

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted file (e.g., a text file with specific content or a malicious spell file) that, when opened in Vim with spell checking enabled, triggers the vulnerable code path. No authentication is required; the attacker only needs to convince the victim to open the malicious file. The overflow occurs during automatic spell suggestion processing. [1]

Impact

Successful exploitation can cause a stack-based buffer overflow, potentially leading to a crash (denial of service) or arbitrary code execution in the context of the Vim process. The exact impact depends on system-level protections such as stack canaries. [1][4]

Mitigation

The vulnerability is fixed in Vim patch 8.2.4247, which is included in Vim version 8.2 and later. Users should upgrade to Vim 8.2 or apply the patch. Gentoo recommends upgrading to >=app-editors/vim-9.0.0060. [1][4] No workaround is known; disabling spell checking may reduce exposure but is not a complete mitigation.