Heap-based Buffer Overflow in vim/vim

Vulnerability

The vulnerability is a heap-based buffer overflow located in the :retab command implementation in Vim. This affects Vim versions prior to patch 8.2.4359. The issue occurs when repeatedly using the :retab command on lines containing tab characters, leading to improper heap memory handling and potential corruption [4].

Exploitation

An attacker can exploit this vulnerability by crafting a file that, when opened in Vim and subjected to repeated :retab commands (for example, via a script or automated action), triggers the heap-based buffer overflow. No authentication is required if the victim opens the malicious file. User interaction is necessary to perform the retab operation [4].

Impact

Successful exploitation could result in arbitrary code execution within the context of the Vim process. This may allow an attacker to execute arbitrary commands on the affected system, potentially leading to full compromise [4].

Mitigation

The vulnerability is fixed in Vim patch 8.2.4359. Users should update to a version that includes this patch or later. As a workaround, avoid opening untrusted files or refrain from using the :retab command if not needed [4].