CVE-2024-43790Heap-based Buffer Overflow in VIM

Severity
5.5MEDIUMNVD
EPSS
0.1%
top 81.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedAug 22
Latest updateSep 11

Description

Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern is displayed at the bottom of the screen in a buffer (msgbuf). When right-left mode (:set rl) is enabled, the search pattern is reversed. This happens by allocating a new buffer. If the search pattern contains some ASCII NUL characters, the buffer allocated will be smaller than the original allocated buffer (because for allocating the reve

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages8 packages

CVEListV5vim/vim< v9.1.0689
NVDvim/vim9.1.04259.1.0689
debiandebian/vim< vim 2:9.1.0698-1 (forky)
Debianvim/vim< 2:9.1.0698-1+1

Patches

🔴Vulnerability Details

2
GHSA
Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass2025-09-11
OSV
CVE-2024-43790: Vim is an open source command line text editor2024-08-22

📋Vendor Advisories

3
Microsoft
CVE-2024-43790: NIST NVD Details: https://nvd2024-12-10
Red Hat
vim: Out of bounds read when performing a search command2024-08-22
Debian
CVE-2024-43790: vim - Vim is an open source command line text editor. When performing a search and dis...2024
CVE-2024-43790 — Heap-based Buffer Overflow in VIM | cvebase