Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.

Accelerate Framework. A memory consumption issue was addressed with improved memory handling.

An integer overflow at an unserializeuep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

An integer overflow at a ureadundo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

Last updated 25 August 2025

Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter.

Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034, and possibly other versions before 7.3.46, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse User32.dll or other DLL that is located in the same folder as a .TXT file. NOTE: some of these details are obtained from third party information.

Description of problem:

Jan Minar has reported the following problem present in Vim shellescape() function implementation and demonstrated by testcases in tar.vim plugin:

The implementation of the shellescape() function does not properly escape all special items, in particular the '!' character). This can result in untrusted data being insufficiently sanitized and possibly lead to arbitrary code execution.

To show this vulnerability can be exploited, the tar.vim plugin test cases has been updated (tarplugin, tarplugin.v2 and tarplugin.updated test cases).

CVE-2008-3074 has been pre-assigned and used in rPath advisory:

http://www.openwall.com/lists/oss-security/2008/07/10/7

References:

http://www.rdancer.org/vulnerablevim-shellescape.html http://www.openwall.com/lists/oss-security/2008/07/15/2 http://www.openwall.com/lists/oss-security/2008/07/10/7 http://www.rdancer.org/vulnerablevim.html http://www.openwall.com/lists/oss-security/2008/07/13/1 http://www.openwall.com/lists/oss-security/2008/08/01/1

Description of problem:

Jan Minar has reported the following problem present in Vim shellescape() function implementation and demonstrated by testcases in zip.vim plugin:

The implementation of the shellescape() function does not properly escape all special items, in particular the '!' character). This can result in untrusted data being insufficiently sanitized and possibly lead to arbitrary code execution.

To show this vulnerability can be exploited, the tar.vim plugin test cases has been updated (zipplugin and zipplugin.v2 test cases).

CVE-2008-3075 as been pre-assigned and used in rPath advisory:

http://www.openwall.com/lists/oss-security/2008/07/10/7 (ZIP-2)

References:

http://www.rdancer.org/vulnerablevim-shellescape.html http://www.rdancer.org/vulnerablevim.html (ZIP-1) http://www.openwall.com/lists/oss-security/2008/07/15/2 http://www.openwall.com/lists/oss-security/2008/07/13/1 (ZIP-4) http://www.openwall.com/lists/oss-security/2008/08/01/1

CVE-2008-2712 bullet (2)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2712

mentions zipplugin based on same advisory as ZIP-1. According to ZIP-2 and ZIP-4 the zip.vim / zipplugin.vim has not been fixed as of Vim 7.2a.19/zip.vim v19, so the bullet (2) -- mention about zipplugin should be removed from CVE-2008-2712.

The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2712 to the following vulnerability:

Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (2) zipplugin, (3) xpm.vim, (4) gzipvim, and (5) netrw.

References: http://www.rdancer.org/vulnerablevim.html http://www.securityfocus.com/archive/1/archive/1/493352/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/493353/100/0/threaded http://marc.info/?l=bugtraq&m=121345541027231&w=4 http://www.openwall.com/lists/oss-security/2008/06/16/2 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=486502

Description of problem:

Ben Schmidt has discovered the following security flaw in Vim, which could lead to arbitrary code execution. Insufficient sanitization can lead to Vim executing arbitrary commands when performing keyword or tag lookup.

Flaw description pasted from original rdancer.org report (see [1]):

3.1. Keyword Lookup -- The K'' Command 3.1.1. Shell Commands and Ex Commands

Because the string passed to the shell for execution is not sanitized, it is possible to specify arbitrary shell commands where Vim expects an argument for the keyword program. Same applies to arbitrary Ex commands.

3.1.2. Keyword Program Command Line Switches

It is possible to specify command line switches for the keyword program in place of the argument. The gravity of this vulnerability depends on the keyword program selected. GNU man, the default keyword program in many installations, supports for example the --pager'' option (cf. the GNU man(1) manual page). This allows arbitrary command execution.

3.2. Tag Lookup -- the Control-]'' and g]'' Commands

Insufficient sanitization of an Ex command argument allows specifying additional arbitrary Ex commands in place of the argument.

3.3. Unknown Shell/Keyword Program

Because the syntax of the shell that is being used to execute the commands is not known beforehand, there may be other unknown vulnerabilities, that are present depending on the shell being used. Ditto for the man(1) program, and other keyword programs.

Version-Release number of selected component (if applicable): 3.0--current, possibly older

How reproducible: Always

Steps to Reproduce: 1. See part "4.EXPLOIT" from the original rdancer.org report [1] Actual results: Arbitrary code execution possible

Expected results: No security flaw present.

References:

[1] http://www.rdancer.org/vulnerablevim-K.html

Proposed patch:

Report: http://groups.google.com/group/vimdev/msg/dd32ad3a84f36bb2 Patch: http://groups.google.com/group/vimdev/attach/dd32ad3a84f36bb2/K-arbitrary-command-execution.patch?part=2

RH SRT official statement:

This issue affects all versions of the vim-enhanced package, as shipped with Red Hat Enterprise Linux 2.1, 3, 4 and 5 and within Fedora releases of 8, 9 and 10.

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrwcurdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.

Last updated 21 August 2024

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking PMLE.

Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1400, When processing nested tuples in Vim script, an error during evaluation can trigger a use-after-free in Vim’s internal tuple reference management. Specifically, the tupleunref() function may access already freed memory due to improper lifetime handling, leading to memory corruption. The exploit requires direct user interaction, as the script must be explicitly executed within Vim. This issue has been patched in version 9.1.1400.

Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1406, when processing nested tuples during Vim9 script import operations, an error during evaluation can trigger a double-free in Vim’s internal typed value (typvalT) management. Specifically, the cleartv() function may attempt to free memory that has already been deallocated, due to improper lifetime handling in the handleimport / eximport code paths. The vulnerability can only be triggered if a user explicitly opens and executes a specially crafted Vim script. This issue has been patched in version 9.1.1406.

Accelerate Framework. A memory consumption issue was addressed with improved memory handling.

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrwmenuescape, EXTRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assertfails or nviminput in Neovim.

Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo() in src/spellfile.c reuses slsalfirst[] without resetting values left by setsalfirst(), so a crafted spell file containing an SNSAL section before an SNSOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.

vim is vulnerable to Heap-based Buffer Overflow

Last updated 2 July 2026

Last updated 13 July 2026

Last updated 13 July 2026

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATHESCCHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.

Accelerate Framework. A memory consumption issue was addressed with improved memory handling.

Accelerate Framework. A memory consumption issue was addressed with improved memory handling.

Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.