heap-buffer-overflow with visual mode in Vim < 9.1.1003

Vulnerability

In Vim versions before 9.1.1003 (including patch 9.1.0938 and earlier), a heap-buffer overflow exists when executing the :all command while visual mode is active. The editor fails to properly terminate visual mode before switching buffers, causing it to access memory beyond the end of a line in the target buffer. The issue was reported by researcher gandalf4a and addressed in patch v9.1.1003 [1][2].

Exploitation

An attacker needs the user to have visual mode enabled and then execute the :all ex command. This can be triggered via a malicious script or sourced file. The provided proof-of-concept demonstrates reproduction with the command vim -u NONE -i NONE -n -m -X -Z -e -s -S ./vim_hbo_1272 -c ':qa!'. No authentication is required beyond local access to Vim [1].

Impact

Successful exploitation results in a heap-buffer overflow, which can lead to memory corruption, denial of service, or potentially arbitrary code execution. The severity is rated Medium because the user must have visual mode active when running :all [1].

Mitigation

The vulnerability is fixed in Vim patch v9.1.1003, released on January 11, 2025. Users should upgrade to at least this version. No workarounds have been provided. The issue is not currently listed in CISA's Known Exploited Vulnerabilities catalog [1][2].