Use of uninitialized resource in Vim - #VU132275

Detailed vulnerability description

The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in read_tree_node() and the Vim spell file parser when parsing a crafted spell file. A remote attacker can supply a crafted .spl file with a BY_INDEX shared-node reference to trigger out-of-bounds heap reads to cause a denial of service and disclose sensitive information.

Exploitation requires a malicious .spl file to be present on the runtimepath and the victim to enable spell checking with the matching language or open a text file whose modeline sets 'spelllang' and enables 'spell' while 'modeline' is enabled.

Remediation

Sources

• https://github.com/vim/vim/security/advisories/GHSA-3h95-3962-mmvf
• https://github.com/vim/vim/commit/25e4e46c584840806b45da20ed