International
The Morning Dev

Only the news worth knowing

‹
 
C21/100

Vulnerability · low

Vim heap buffer overflow via crafted spell file in versions before 9.2.1309

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Vim users running versions before 9.2.1309

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

Popular tool

What to do

  1. Upgrade Vim to version 9.2.1309 or later

The Brief

  • A heap buffer overflow in Vim can be triggered by a crafted spell file.
  • The issue affects Vim versions before 9.2.1309.
  • The advisory rates severity as Low, and no CVE has been assigned yet (requested only).

Why it matters

Developers and sysadmins who run Vim older than 9.2.1309 should update, since opening a crafted spell file can corrupt memory.

The checklist behind the tier

Checklist · 2 of 10 yes
YesHits tech teamsJudgment: Vim is a text editor that developers and ops teams use daily.
NoCore infrastructureJudgment: Vim is a widely used editor, not core infrastructure like OpenSSH or glibc.
YesPopular toolJudgment: Vim is a mainstream, widely used developer tool.
NoExploited in the wildOpen Source Security advisory: no observed attacks reported, severity Low, CVE not yet assigned.
NoPublic exploitOpen Source Security advisory: only an advisory is cited; no exploit code or PoC is mentioned.
NoRemote, no loginOpen Source Security advisory: the flaw is triggered by a crafted spell file, which needs user interaction.
NoFull takeoverOpen Source Security advisory: describes a heap buffer overflow but does not state code execution or privilege escalation.
NoSecrets exposedOpen Source Security advisory: no data theft or exposure of secrets or source code is reported.
NoSupply chainOpen Source Security advisory: a vulnerability in Vim itself, with no compromised package, build or update channel.
NoNo fix yetOpen Source Security advisory: affects versions before 9.2.1309, implying a fixed release exists.

Timeline

  1. Heap buffer overflow with crafted spell file disclosed by Christian Brabandt on oss-security

  2. Open Source Security

    [vim-security]: Heap Buffer Overflow with Crafted Spell File in Vim < 9.2.1309

Source

[vim-security]: Heap Buffer Overflow with Crafted Spell File in Vim < 9.2.1309 ↗ Open Source Security · 3h ago

First seen · 1 source · Full story page · How tiers are decided