NULL Pointer Dereference in vim/vim

Vulnerability

A NULL pointer dereference vulnerability exists in gui_do_scroll() in the Vim source code prior to commit 20d161ace307e28690229b68584f2d84556f8960 (patch 9.0.1992). The function gui_do_scroll() could be called while Vim is in exmode (when exmode_active is set), leading to a redraw attempt that uses invalid LineOffset and similar values. This triggers a NULL pointer dereference and a segfault. Affected versions are all Vim releases before the patch was applied.

Exploitation

An attacker must be able to supply a crafted file or input that causes Vim to enter exmode and then trigger a scroll event (e.g., pressing a scrollbar key in insert mode). The test case in the commit shows a sequence: entering insert mode and then pressing k_VerScrollbar while in exmode. No special network position or authentication is needed; the attack can be performed by a local user opening a malicious file.

Impact

Successful exploitation causes Vim to crash (denial of service) due to the NULL pointer dereference. There is no indication of code execution or information disclosure beyond the program termination. The crash occurs within the Vim process and does not elevate privileges.

Mitigation

The fix is included in Vim patch 9.0.1992, available in the commit 20d161ace307e28690229b68584f2d84556f8960 [1]. Users should update to Vim version containing this patch or later. The official source repository and likely downstream distros have applied the fix. No workaround is provided in the references; updating Vim is the recommended action.