Heap Buffer Overflow with Crafted Spell File in Vim < 9.2.1309 ============================================================== Date: 08.11.2026 Severity: Low CVE: requested, not yet assigned CWE: Access of Resource Using Incompatible Type (CWE-843), Out-of-bounds Read (CWE-125)
Summary A crafted spell file (.spl) containing two SNSOFO sections causes Vim to free the soundfolding items of the first section as if they were SNSAL items, reading beyond the allocated memory. The spell file can be loaded by a modeline, so opening a file is enough to trigger the issue.
Description The SNSAL and SNSOFO sections of a spell file both store their soundfolding information in slsal. For an SNSOFO section, setsofo() uses slsal as an array of 256 int pointers. Before doing so, it calls freesalitems() to free any previous contents, which treats the array as salitemT entries.
Vim only writes either an SNSAL or an SNSOFO section, but the spell file reader accepted any number of them. When a second SNSOFO section follows the first one, freesalitems() interprets the int array as salitemT entries, reading beyond the end of the allocation and passing the read values to vimfree().
Since 'spelllang' accepts the name of a .spl file and can be set from a modeline together with 'spell', a crafted spell file is loaded when a file containing such a modeline is opened.
Impact A heap out-of-bounds read, resulting in a crash of Vim. An invalid free has not been demonstrated but cannot be ruled out.
Exploitation requires:
the crafted .spl file and a file with a modeline setting 'spell' and 'spelllang' to it, e.g. in a cloned repository or an extracted archive, 'modeline' being enabled a multi-byte 'encoding' such as utf-8 (the default in most environments).
Acknowledgements The Vim project would like to thank pangflame for reporting the issue.
References The issue has been fixed as of Vim patch v9.2.1309.
- Commit - Github Security Advisory
Thanks, Christian -- Fenster verschmutzen viel weniger, wenn man die Scheiben herausnimmt.
Insecure Socket Directory in Vim < 9.2.1308 =========================================== Date: 08.11.2026 Severity: Medium CVE: requested, not yet assigned CWE: Unverified Ownership (CWE-283), Incorrect Default Permissions (CWE-276)
Summary When using the socketserver backend of the clientserver feature, Vim places its socket in a per-user directory such as /tmp/vim-<uid>. An existing directory was used without checking its owner or permissions, and the socket was created with the user's umask. A local attacker can pre-create this directory and then connect to or replace the victim's server socket, which allows evaluating arbitrary Vim expressions in the victim's Vim.
Description socketservergetpath() creates the socket directory $XDGRUNTIMEDIR/vim or $TMPDIR/vim-<uid> (/tmp if $TMPDIR is unset) using:
if (vimmkdir(buf, 0700) == -1 && errno != EEXIST) continue;
If the directory already exists, it is used as-is. Since /tmp is world-writable, another user can create /tmp/vim-<uid> for the victim's uid beforehand, owned by the attacker and with permissive mode. channellistenunix() then binds the server socket inside that directory with permissions 0777 & ~umask. The socketserver does not authenticate connecting clients and evaluates "expr" messages using evalclientexprtostring(), and "keystrokes" messages are inserted into the input buffer.
With a permissive umask (e.g. 002 or 000) the attacker can connect to the socket directly. With the common umask 022 a direct connect fails, but since the attacker owns the directory, they can still remove or replace the socket and impersonate the server towards clients.
Impact Arbitrary Vim expression evaluation, and therefore arbitrary shell command execution, in the context of the user running Vim, on multi-user systems.
Exploitation requires:
a Vim build with the +socketserver feature, used as server (e.g. using --servername or with +autoservername), the attacker having a local account on the same system, the socket directory being located in a shared directory such as /tmp ($XDGRUNTIMEDIR is not affected, since it is only accessible by the user), for direct code execution: a umask that makes the socket accessible by the attacker.
Acknowledgements The Vim project would like to thank Calif.io and 360AlphaLab for independently reporting the issue.
References The issue has been fixed as of Vim patch v9.2.1308.
- Commit - Github Security Advisory
Thanks, Christian -- Das Glück kann nicht wie ein mathematischer Lehrsatz bewiesen werden, es muß empfunden werden, wenn es da sein soll. -- Heinrich von Kleist
Vim is an open source, command line text editor. Prior to 9.2.0841, propaddone() in src/textprop.c uses the proplen value from gettextprops() to increment a uint16t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.
Vim is an open source, command line text editor. Prior to 9.2.0841, propaddone() in src/textprop.c uses the proplen value from gettextprops() to increment a uint16t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.
A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.
Last updated 24 July 2024
Last updated 24 July 2024
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
apache. Multiple issues were addressed by updating apache to version 2.4.53.
apache. Multiple issues were addressed by updating apache to version 2.4.53.
Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.