segmentation fault in win_line() in Vim < 9.1.1043

Vulnerability

The vulnerability resides in the win_line() function (drawline.c:3977) of Vim. When Vim is run in silent Ex mode (-s -e), it normally operates without a screen. However, feeding specially crafted binary characters can trigger gui_do_scroll(), which calls updateWindow(). This attempts to access the ScreenLines pointer, which has not been allocated because no screen exists, resulting in a segmentation fault. Affected versions are Vim before 9.1.1043. The issue is fixed in Vim 9.1.1043 [1][2].

Exploitation

An attacker needs to provide binary characters to Vim while it is running in silent Ex mode (-s -e). The user must explicitly execute Vim with these flags and feed the binary data, for example via a malicious script file using -S. No authentication or network access is required; the attack is local. The specific command to reproduce is vim -u NONE -i NONE -n -m -X -Z -e -s -S <poc_file> -c :qa!. Feeding the binary content triggers the scroll function, leading to a crash [1].

Impact

Successful exploitation causes a segmentation fault, resulting in denial of service. This is classified as an out-of-bounds write (CWE-787). The impact is considered medium because it requires user interaction (feeding binary data in ex mode). There is no indication of code execution or data leakage from the references [1].

Mitigation

The vulnerability is fixed in Vim version 9.1.1043. Users should update to this version or later. If updating is not immediately possible, avoid running Vim in silent Ex mode with untrusted input. The fix adds a check for ScreenLines being NULL before calling updateWindow() in gui_do_scroll() [1][2].