SB2026110904 - Unverified Ownership in Vim

Description

This security bulletin contains information about 1 vulnerability.

1) Unverified Ownership (CVE-ID: N/A)

CWE-ID: CWE-283 - Unverified Ownership

CVSSv4: 7.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary shell commands in the context of the user running Vim or impersonate the Vim server to clients.

The vulnerability exists due to unverified ownership and permissions of an existing socket directory in socketserver_get_path() when creating a server socket in a shared directory such as /tmp. A remote attacker can pre-create the victim's socket directory to connect to the socket and submit arbitrary Vim expressions when the victim's umask permits access, or replace the socket to impersonate the server to clients.

Exploitation requires a Vim build with the +socketserver feature operating as a server.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/security/advisories/GHSA-p99j-mfjp-r4cg
• https://github.com/vim/vim/commit/a448e0c6bc459d7dbeab581bcb76a0d