Heap-based Buffer Overflow occurs in vim in vim/vim

Vulnerability

A heap-based buffer overflow exists in Vim in the spell suggestion functionality (spell_suggest). When the z= command is used in Visual mode, the code could read beyond the end of the current line, leading to a buffer overflow. This affects Vim versions prior to 8.2.4563 [2]. The vulnerability occurs because the length of the bad word (badlen) is not properly bounded by the remaining column count on the line after ending visual mode [2].

Exploitation

An attacker can trigger this vulnerability by providing a crafted file or text that, when opened in Vim, causes the user (or an automated editor script) to invoke the z= spelling suggestion command in Visual mode. The attacker must have a way to supply the crafted content to the victim; no additional special privileges are required beyond the ability to write the file or have it processed. The fix in the patch also includes a test case that demonstrates the crash by using a sequence of Visual mode operations and then z= [2].

Impact

Successful exploitation could lead to arbitrary code execution, as the heap-based buffer overflow may corrupt adjacent memory. The impact is disclosure in the Apple security advisory notes that processing a maliciously crafted image could lead to arbitrary code execution [1], and the Vim commit addresses a heap-buffer-overflow that could have security implications.

Mitigation

The vulnerability is fixed in Vim version 8.2.4563, released on March 14, 2022 [2]. Users should update their Vim installation to at least version 8.2.4563 or apply the corresponding patch. The fix was also included in macOS Ventura 13 (released October 24, 2022) as part of its security updates [1]. Fedora package announcements are referenced [3][4] but do not provide additional mitigation details.