vim up to 9.1.688 Search Pattern heap-based overflow

Summaryinfo

A vulnerability described as critical has been identified in vim up to 9.1.688. Affected by this vulnerability is an unknown functionality of the component Search Pattern Handler. The manipulation results in heap-based overflow. This vulnerability is identified as CVE-2024-43790. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in vim up to 9.1.688. Affected is an unknown code block of the component Search Pattern Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern is displayed at the bottom of the screen in a buffer (msgbuf). When right-left mode (:set rl) is enabled, the search pattern is reversed. This happens by allocating a new buffer. If the search pattern contains some ASCII NUL characters, the buffer allocated will be smaller than the original allocated buffer (because for allocating the reversed buffer, the strlen() function is called, which only counts until it notices an ASCII NUL byte ) and thus the original length indicator is wrong. This causes an overflow when accessing characters inside the msgbuf by the previously (now wrong) length of the msgbuf. The issue has been fixed as of Vim patch v9.1.0689.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-43790 since 08/16/2024. The exploitability is told to be difficult. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 212971 (CBL Mariner 2.0 Security Update: vim (CVE-2024-43790)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.1.0689 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (212971) and CERT Bund (WID-SEC-2025-1439). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• SUSE Linux
• Dell Secure Connect Gateway

Productinfo

Type

• Word Processing Software

Name

• vim

Version

• 9.1.688

License

• open-source

Website

• Product: https://github.com/vim/vim/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion