CVE-2023-48706 Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite

2023-11-2222:03:39

CWE-416

GitHub_M

www.cve.org

vim

unix

heap-use-after-free

vulnerability

skipwhite

charset.c

3.6 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

5.8 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

19.1%

JSON

Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive :s call causes free-ing of memory which may later then be accessed by the initial :s command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.

CNA Affected

[
  {
    "vendor": "vim",
    "product": "vim",
    "versions": [
      {
        "version": "< 9.0.2121",
        "status": "affected"
      }
    ]
  }
]