SB2026082720 - Out-of-bounds write in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in libvterm resize handling when rendering attacker-controlled terminal output containing a crafted resize escape sequence. A remote attacker can send crafted terminal output to cause a denial of service.

Exploitation requires Vim to be compiled with the terminal feature, a terminal window to be open, and the escape sequence and subsequent output to arrive as a continuous stream without a redraw in between.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-vfc7-mhvm-gjp8
• https://github.com/vim/vim/commit/e4f51e505ae0d64c4797c89314ecff1be88135be