Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite

Vulnerability

Vim versions prior to 9.0.2121 contain a heap-use-after-free vulnerability in the ex_substitute() function. The bug is triggered when a user executes a :s substitution command for the first time in a session and includes a sub-replace-special atom (e.g., ~\=) that causes a recursive :s call. The recursive call can free memory that the initial call later accesses, leading to a use-after-free condition [1][2][4].

Exploitation

Exploitation requires the user to run a crafted :s command as the first substitution in a Vim session. The command must contain a sub-replace-special atom that invokes a recursive substitution, causing the use-after-free. The attacker must convince the user to open a malicious file or execute the command directly. The process is delicate and may not always succeed, but can result in a crash [1][4].

Impact

Successful exploitation leads to a heap-use-after-free, which can cause Vim to crash or potentially allow arbitrary code execution if the freed memory is controlled. The impact is considered low because the attacker requires user interaction and the exploitation is tricky to reproduce reliably [1][4].

Mitigation

The vulnerability is fixed in Vim version 9.0.2121 [2]. Users should update to this version or later. No workaround is available for unpatched versions. The issue is not listed in CISA's Known Exploited Vulnerabilities catalog as of publication [1][4].