heap buffer overflow in get_one_sourceline in vim/vim

Vulnerability

A heap buffer overflow vulnerability exists in the get_one_sourceline function in Vim prior to version 8.2.4647 [3]. The bug occurs when processing source lines: the code did not properly check for buffer growth before appending a NUL terminator, leading to writing past the allocated heap memory on long lines [3]. The affected versions are all Vim releases before the patch 8.2.4647 [3].

Exploitation

An attacker can exploit this by providing a crafted file with an unusually long line via the :source command or by opening a specially crafted file that triggers the vulnerable code path [3]. No special privileges are required beyond normal file access; the user must be tricked into sourcing or opening the malicious file [3].

Impact

Successful exploitation results in a heap buffer overflow, which can cause a denial of service (crash) or potentially allow arbitrary code execution in the context of the Vim process [3][4]. The vulnerability is classified as high severity [4].

Mitigation

The vulnerability is fixed in Vim version 8.2.4647 and later [3]. Users should update to at least that version. Distributions such as Fedora have released updated packages [1][2], and Gentoo recommends upgrading to >=app-editors/vim-9.0.0060 [4]. No workaround is available; applying the patch or upgrading is the only mitigation [4].