Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
vim:vim
References 3
https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64
https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64
https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a
https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a
https://github.com/vim/vim/releases/tag/v9.2.0846
https://github.com/vim/vim/releases/tag/v9.2.0846