Heap-based Buffer Overflow in vim/vim

Vulnerability

A heap-based buffer overflow exists in Vim versions prior to 9.0.1144, specifically in the msg_puts_printf function. The issue arises from an improper length check when handling strings, allowing a write beyond the allocated heap buffer [2].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted input file to Vim. No authentication is required; the user only needs to open the malicious file with Vim or trigger the relevant code path. The bug is reachable through standard editing operations involving multibyte expressions or similar features [2].

Impact

Successful exploitation can lead to heap corruption, potentially causing a denial of service or arbitrary code execution in the context of the Vim process. This could allow an attacker to execute commands or access sensitive data on the affected system.

Mitigation

The vulnerability is fixed in Vim version 9.0.1144 [2]. Gentoo recommends upgrading to Vim 9.0.1157 or later [3]. No other workaround is available at this time.