SB2026072421 - Heap-based buffer overflow in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to an integer overflow leading to a heap-based buffer overflow in prop_add_one() in src/textprop.c when adding text properties to a single line. A remote attacker can add a large number of crafted text properties to trigger an out-of-bounds heap write and to cause a denial of service and potentially execute arbitrary code.

Exploitation requires Vim to be built with the textprop feature and requires a script or plugin path that causes 65536 text properties to be added to a single line, such as processing attacker-controlled file contents through a plugin.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j
• https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b