VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 16, 2023· Updated Feb 13, 2025

overflow in get_number in vim

CVE-2023-48236

Description

Vim prior to 9.0.2111 allows integer overflow via the z= command when using large count values, leading to a potential crash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Vim prior to 9.0.2111 allows integer overflow via the z= command when using large count values, leading to a potential crash.

Vulnerability

The z= command in Vim can overflow its count argument when the user provides a value larger than MAX_INT. This affects versions prior to 9.0.2111. The bug is triggered when the user interacts with the editor and executes the command with a crafted count. The overflow may cause undefined behavior or a crash. The vulnerability is fixed in commit 73b2d379, included in version 9.0.2111 [1].

Exploitation

An attacker must convince a user to run the z= command with an excessively large count value. The user interaction is required, and the overflow occurs during command processing. The exact sequence involves the user typing z= followed by a number larger than MAX_INT. The vulnerability does not require elevated privileges.

Impact

Successful exploitation can lead to a denial of service via a crash. The impact is rated low because user interaction is required and the crash may not occur in all situations. No remote code execution or data compromise is described.

Mitigation

Upgrade to Vim version 9.0.2111 or later, which contains the fix (commit 73b2d379). No workarounds are available [1]. Users should update their Vim installation via their package manager or by compiling the latest source code.

References
  1. security - [vim-security] several minor security issues in Vim v9.0.2106-v9.0.2112

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

27

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.