Heap-based buffer overflow in Vim - #VU139259

Vulnerability details

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to an integer overflow leading to a heap-based buffer overflow in prop_add_one() in src/textprop.c when adding text properties to a single line. A remote attacker can add a large number of crafted text properties to trigger an out-of-bounds heap write and to cause a denial of service and potentially execute arbitrary code.

Exploitation requires Vim to be built with the textprop feature and requires a script or plugin path that causes 65536 text properties to be added to a single line, such as processing attacker-controlled file contents through a plugin.

Affected software

Remediation

External References

• https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j
• https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b

Related Security Bulletins

• Heap-based buffer overflow in Vim