Out-of-bounds Write in vim/vim

Vulnerability

An out-of-bounds write vulnerability exists in Vim's do_string_sub function, triggered during recursive substitute expressions. The flaw occurs when vim_regsub returns a sublen value of zero or negative, leading to invalid memory access. This affects Vim versions prior to 9.0.1145 [2].

Exploitation

An attacker can craft a file containing a recursive substitute expression (e.g., using :s/\%')/\=Repl(...)) that causes sublen to be non-positive. The user must open the malicious file in Vim and execute the substitute command. No authentication or special privileges are required beyond file access.

Impact

Successful exploitation results in an out-of-bounds write, potentially causing memory corruption. This can lead to denial of service or, in some cases, arbitrary code execution. The exact impact depends on the memory layout and the attacker's ability to control the overwritten data.

Mitigation

The vulnerability is fixed in Vim version 9.0.1145 [2]. Gentoo recommends upgrading to version 9.0.1157 or later [3]. No workaround is available; users should update their Vim installation immediately.