VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 2, 2024· Updated Oct 4, 2024

heap-buffer-overflow in Vim

CVE-2024-45306

Description

A heap-buffer-overflow in Vim versions 9.1.0038 to 9.1.0706 due to invalid cursor position after an optimization patch.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap-buffer-overflow in Vim versions 9.1.0038 to 9.1.0706 due to invalid cursor position after an optimization patch.

Vulnerability

Vim versions between v9.1.0038 and v9.1.0706 (inclusive) are affected by a heap-buffer-overflow vulnerability. Patch v9.1.0038 optimized cursor position calculation by removing a loop that verified the cursor always pointed inside a line. This removal can lead to the cursor pointing beyond the end of a line, causing a heap-buffer-overflow when accessing the line pointer at that position [1]. The exact conditions leading to an invalid cursor position are not yet fully understood [1].

Exploitation

The specific attack vector is unclear; no test case was included in the fix. The only observed occurrences have been during fuzzing with specially crafted files, not during normal editing sessions [1]. An attacker would likely need to supply a crafted file that triggers the invalid cursor state, potentially through pasted content or specific editing sequences [1].

Impact

The impact is limited to a program crash (denial of service) [1]. The Vim project rates the severity as low because only crashes from fuzzing have been seen, with no evidence of arbitrary code execution or data corruption [1].

Mitigation

Users should upgrade to Vim patch v9.1.0707 or later, which fixes the issue by adding a bounds check on the cursor column position [1][3]. No workaround is available for unpatched versions [1].

References
  1. heap-buffer-overflow in Vim >= 9.1.0038 and Vim < 9.1.0707
  2. patch 9.1.0707: [security]: invalid cursor position may cause a crash · vim/vim@396fd1e

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

22

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"A removed loop that validated cursor position allowed it to become invalid, leading to a heap-buffer-overflow."

Attack vector

The vulnerability is triggered when the cursor position becomes invalid, pointing beyond the end of a line. This situation can arise after patch v9.1.0038 optimized cursor position calculation and removed a validation loop. The exact conditions leading to an invalid cursor position are not fully understood, and the observed impact has been a program crash rather than a security compromise during editing sessions [ref_id=1].

Affected code

The vulnerability stems from changes made in patch v9.1.0038, which optimized cursor position calculation and removed a validation loop. This resulted in the cursor position potentially remaining invalid, leading to a heap-buffer-overflow when accessing the line pointer at the specified cursor position. The issue is described as occurring within functions related to editing and character insertion, as indicated by ASAN output referencing `ins_char_bytes` and `bracketed_paste` [ref_id=1].

What the fix does

Patch v9.1.0707 reintroduces the validation loop that was removed in v9.1.0038. This loop ensures that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line, thereby preventing the heap-buffer-overflow condition [ref_id=1].

Generated on Jun 6, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.