VYPR
← All advisories
Unrated severityNVD Advisory· Published May 9, 2023· Updated Aug 2, 2024

NULL Pointer Dereference in vim/vim

CVE-2023-2609

Description

NULL pointer dereference in vim's get_register() prior to 9.0.1531 could cause a crash when register contents become invalid.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

NULL pointer dereference in vim's get_register() prior to 9.0.1531 could cause a crash when register contents become invalid.

Vulnerability

A NULL pointer dereference exists in the get_register() function of vim prior to version 9.0.1531. The flaw occurs when the register's y_current->y_array pointer becomes NULL while y_size is non-zero, leading to a crash. The issue was introduced in an earlier patch and is triggered under specific conditions where register contents are manipulated into an invalid state [3].

Exploitation

An attacker would need to craft input that causes vim to process a register with a NULL y_array pointer. The provided test case in the fix demonstrates a sequence of commands that triggers the crash, including setting the encoding and using specific normal mode operations. No authentication or special privileges are required beyond the ability to supply a file or commands to vim [3].

Impact

Successful exploitation results in a denial of service (crash) of the vim process. The vulnerability does not appear to allow arbitrary code execution or information disclosure based on the available references [3].

Mitigation

The vulnerability is fixed in vim version 9.0.1531, released with commit d1ae8366aff286d41e7f5bc513cc0a1af5130aad [3]. Users should upgrade to this version or later. No workaround is documented in the available references.

References
  1. patch 9.0.1531: crash when register contents ends up being invalid · vim/vim@d1ae836

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

33

Patches

0

No patches discovered yet.

Vulnerability mechanics

Synthesis attempt was rejected by the grounding validator. Re-run pending.

References

5

News mentions

0

No linked articles in our index yet.