VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 5, 2023· Updated Nov 3, 2025

Heap-based Buffer Overflow in vim/vim

CVE-2023-4781

Description

A heap-buffer-overflow in vim/vim prior to 9.0.1873 allows arbitrary code execution via crafted input.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap-buffer-overflow in vim/vim prior to 9.0.1873 allows arbitrary code execution via crafted input.

Vulnerability

A heap-based buffer overflow vulnerability exists in the vim_regsub_both function of Vim prior to version 9.0.1873. This flaw is triggered when processing specially crafted input files, leading to out-of-bounds memory access.

Exploitation

An attacker can exploit this vulnerability by supplying a malicious file to a user who then opens it with an affected version of Vim. No special network access or elevated privileges are required beyond the ability to persuade the target to open the crafted file [2][3].

Impact

Successful exploitation can lead to unexpected application termination or arbitrary code execution, potentially compromising the security of the affected system [1][2]. The impact includes disclosure of sensitive information, modification of data, or full control of the application context.

Mitigation

The vulnerability is fixed in Vim version 9.0.1873, released on August 23, 2023 [2]. Apple has also addressed this issue in macOS Sonoma 14.1 by removing the vulnerable code [1]. Users should update to the latest patched version. No workaround is available for unpatched versions.

References
  1. About the security content of macOS Sonoma 14.1 - Apple Support
  2. patch 9.0.1873: [security] heap-buffer-overflow in vim_regsub_both · vim/vim@f6d28fe
  3. The world’s first bug bounty platform for AI/ML

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

28

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.