VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 2, 2023· Updated Nov 3, 2025

Heap-based Buffer Overflow in vim/vim

CVE-2023-5344

Description

Heap-based buffer overflow in Vim's trunc_string() function allows arbitrary code execution via crafted input.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Heap-based buffer overflow in Vim's trunc_string() function allows arbitrary code execution via crafted input.

Vulnerability

A heap-based buffer overflow exists in the trunc_string() function of Vim versions prior to 9.0.1969. The function incorrectly uses the index e instead of buflen when null-terminating a truncated string, leading to an out-of-bounds write on the heap [4]. This vulnerability is reachable when Vim processes text that triggers string truncation, such as long lines or specially crafted file content.

Exploitation

An attacker can exploit this vulnerability by providing a malicious file or input that causes Vim to call trunc_string() with a buffer length that results in an overflow. No authentication is required; the victim only needs to open the crafted file with an affected version of Vim. The overflow occurs during the null-termination step, writing a single NUL byte beyond the allocated buffer [4].

Impact

Successful exploitation of this heap-based buffer overflow can lead to arbitrary code execution in the context of the Vim process. An attacker could potentially gain control of the system or execute arbitrary commands with the privileges of the user running Vim.

Mitigation

The vulnerability is fixed in Vim version 9.0.1969, released on 2023-10-02 [4]. Users should update to this version or later. No workaround is available; updating is the only mitigation.

References
  1. patch 9.0.1969: [security] buffer-overflow in trunc_string() · vim/vim@3bd7fa1

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

28

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.