Heap-based Buffer Overflow in vim/vim

Vulnerability

A heap-based buffer overflow vulnerability exists in the vim_regsub_both() function of Vim prior to version 9.0.1848 [1][2]. The flaw occurs when Vim processes a specially crafted file, leading to an out-of-bounds write in heap memory. The affected code path is reachable during file parsing without requiring special configuration beyond opening a malicious file [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a crafted file with Vim. No authentication or special privileges are required; the attack is triggered simply by parsing the malicious input. The exploit does not require user interaction beyond the act of opening the file [1].

Impact

Successful exploitation can lead to an unexpected application termination (denial of service) or arbitrary code execution in the context of the Vim process [1]. The attacker gains the ability to execute arbitrary code with the privileges of the user running Vim, potentially leading to full compromise of the user's session or data.

Mitigation

The vulnerability is fixed in Vim version 9.0.1848, released on an unspecified date [2]. The fix involves correcting the buffer handling in vim_regsub_both(). Apple also addressed this CVE in macOS Sonoma 14.1 by removing the vulnerable code [1]. Users are advised to update to Vim 9.0.1848 or later [2]. No workarounds are documented for earlier versions.