SB2026082721 - Incorrect Calculation of Buffer Size in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect Calculation of Buffer Size (CVE-ID: N/A)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an incorrect calculation of buffer size in unserialize_uep() in src/undo.c when reading a crafted persistent undo file. A remote attacker can supply a specially crafted undo file to cause a denial of service.

Only 32-bit builds are vulnerable. The issue can be triggered either explicitly with :rundo or automatically when the 'undofile' option is enabled and a matching undo file is found for the edited file.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-cvc5-p4x9-3f9f
• https://github.com/vim/vim/commit/e41756455701b9419f2493ab2e2e0f01557fe939