Stack-based Buffer Overflow in vim/vim

Vulnerability

A stack-based buffer overflow vulnerability exists in vim versions prior to 8.2. The bug resides in the core text processing logic, potentially triggered by opening a specially crafted file.

Exploitation

An attacker can exploit this by crafting a malicious file that, when opened in vim, overflows a stack buffer. No special privileges are required; the victim simply needs to open the file with vim.

Impact

Successful exploitation could lead to arbitrary code execution or denial of service, depending on the payload. The crash might be leveraged for code execution at the privilege level of the user running vim.

Mitigation

The vulnerability is fixed in vim version 8.2 and later. Gentoo Linux recommends upgrading to vim-9.0.0060 or later [4]. Users should update their vim installation accordingly. No known workarounds exist.