Incorrect Calculation of Buffer Size in Vim - #VU145884

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an incorrect calculation of buffer size in unserialize_uep() in src/undo.c when reading a crafted persistent undo file. A remote attacker can supply a specially crafted undo file to cause a denial of service.

Only 32-bit builds are vulnerable. The issue can be triggered either explicitly with :rundo or automatically when the 'undofile' option is enabled and a matching undo file is found for the edited file.

Affected software

Remediation

External References

• https://github.com/vim/vim/security/advisories/GHSA-cvc5-p4x9-3f9f
• https://github.com/vim/vim/commit/e41756455701b9419f2493ab2e2e0f01557fe939

Related Security Bulletins

• Incorrect Calculation of Buffer Size in Vim