VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 3, 2023· Updated Mar 7, 2025

Heap-based Buffer Overflow in vim/vim

CVE-2023-1170

Description

A heap-based buffer overflow in vim's do_put function, fixed in 9.0.1376, could allow memory corruption via crafted Visual block operations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap-based buffer overflow in vim's do_put function, fixed in 9.0.1376, could allow memory corruption via crafted Visual block operations.

Vulnerability

A heap-based buffer overflow exists in the do_put function of vim versions prior to 9.0.1376. The flaw occurs when performing a put operation in Visual block mode under specific conditions. As shown in the fix commit [4], the vulnerability is addressed by correcting a condition check (spaces vs shortline) and adding bounds verification for the cursor position after the put operation to prevent accessing invalid memory.

Exploitation

An attacker would need to craft a file or input that triggers the problematic code path during a do_put call in Visual block mode. Successful exploitation requires the victim to open the malicious file in vim and execute a put command in Visual block select mode, which leads to the heap-based overflow.

Impact

If successfully exploited, this vulnerability can cause heap memory corruption, potentially leading to a crash or arbitrary code execution. The precise impact depends on the heap layout and attacker control, but the issue is classified as a heap-based buffer overflow with high severity.

Mitigation

The vulnerability is fixed in vim version 9.0.1376, released on or around March 3, 2023. Users should update to this version or later. No known workarounds are available for earlier versions. The fix is included in subsequent releases and distributions should update their packages accordingly [4].

References
  1. patch 9.0.1376: accessing invalid memory with put in Visual block mode · vim/vim@1c73b65

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

33

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.