Buffer Over-read in function find_next_quote in vim/vim

Vulnerability

Buffer over-read in the find_next_quote function in vim prior to version 8.2.4925. The function fails to check for end-of-line after incrementing the column index when encountering an escape character, leading to reading past the end of the line. This occurs when a trailing backslash is present. Affected versions: all vim versions before 8.2.4925.

Exploitation

An attacker can exploit this by providing a specially crafted text file containing a line with a trailing backslash. When vim processes this file (e.g., during syntax highlighting or other operations that call find_next_quote), the buffer over-read occurs. No authentication or special privileges are required; the victim only needs to open the malicious file in vim.

Impact

The buffer over-read can cause a crash (denial of service). In some cases, it may lead to memory corruption and potentially arbitrary code execution, as stated in the CVE description. The impact is limited to the vim process.

Mitigation

Fixed in vim version 8.2.4925 [2]. Users should upgrade to at least this version. Gentoo recommends upgrading to >=9.0.0060 [4]. Apple included a fix in macOS Ventura 13 [1] (though the advisory mentions a different impact, it likely addresses this CVE). No workaround is available.