heap-buffer-overflow in do_search() in Vim < 9.1.0689

Vulnerability

A heap-buffer-overflow vulnerability exists in Vim's do_search() function in versions between v9.1.0425 and v9.1.0689 [1]. When the search-count message is disabled via :set shm+=S and right-left mode is enabled via :set rl, the search pattern is reversed into a new buffer. If the pattern contains ASCII NUL bytes, the strlen() function used for the reversed buffer allocation returns a shorter length than the original buffer, causing the original length indicator to be wrong. This leads to a heap-buffer-overflow when accessing characters in the msgbuf [1].

Exploitation

An attacker must craft a search pattern containing ASCII NUL bytes and persuade a victim to run Vim with both :set shm+=S and :set rl enabled, then perform a search [1]. The victim does not need any special privileges or network access, as this occurs locally when editing a file. The attacker can supply the pattern through a malicious file or command [1].

Impact

Successful exploitation causes a heap-buffer-overflow, typically resulting in a crash due to a read of invalid memory [1]. The impact is low because the required settings (shm+=S and rl) are not default and rarely used together, and the pattern must contain NUL bytes [1]. No code execution or privilege escalation is described in the references.

Mitigation

The issue is fixed in Vim patch v9.1.0689 [1]. Users should update to Vim version 9.1.0689 or later [2]. For users unable to update, avoid enabling both :set shm+=S and :set rl simultaneously, and do not open untrusted files that may cause such a search [1].