VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 16, 2023· Updated Feb 13, 2025

overflow in nv_z_get_count in vim

CVE-2023-48234

Description

Vim's normal mode z command can overflow for large counts, leading to a potential crash with user interaction.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Vim's normal mode z command can overflow for large counts, leading to a potential crash with user interaction.

Vulnerability

In Vim, when obtaining the count for a normal mode z command, an integer overflow could occur for large counts. This issue affects Vim versions prior to the fix in commit 58f9befca1 included in release 9.0.2109 [1]. The overflow occurs in the calculation logic for the z command count, and user interaction is required to trigger the vulnerable code path [1].

Exploitation

An attacker would need to entice a user running a vulnerable Vim version into executing a normal mode z command with a specially crafted large count. This could be done by opening a file that contains a sequence of keystrokes or by social engineering the user to type the command. The user interaction is required, and the race window is not relevant here [1].

Impact

Successful exploitation could result in a crash of Vim. The impact is rated low because a crash may not occur in all situations and achieving code execution is considered unlikely [1]. The compromise is limited to denial of service via a crash.

Mitigation

The vulnerability is fixed in Vim version 9.0.2109 and later [1]. Users are advised to upgrade to this version or later. There are no known workarounds for this issue [1].

References
  1. security - [vim-security] several minor security issues in Vim v9.0.2106-v9.0.2112

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

27

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.