CVE-2024-43802
published 2024-08-26CVE-2024-43802: Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not…
PriorityP420medium4.5CVSS 3.1
AVLACHPRNUIRSUCLILAL
EPSS
0.30%
21.6th percentile
Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | vim | < vim 2:9.0.1378-2+deb12u1 (bookworm) | vim 2:9.0.1378-2+deb12u1 (bookworm) |
| msrc | azl3_vim_9.1.0697-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_vim_9.1.0791-4_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_vim_9.1.0697-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_vim_9.1.0791-4_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| vim | vim | < 9.1.0697 | 9.1.0697 |
| vim | vim | >= 0 < 2:8.2.2434-3+deb11u2 | 2:8.2.2434-3+deb11u2 |
| vim | vim | >= 0 < 2:9.0.1378-2+deb12u1 | 2:9.0.1378-2+deb12u1 |
| vim | vim | >= 0 < 2:9.1.0698-1 | 2:9.1.0698-1 |
| vim | vim | >= 0 < 2:9.1.0698-1 | 2:9.1.0698-1 |
CVSS provenance
nvdv3.14.5MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
osv4.5MEDIUM
vendor_debian4.5MEDIUM
vendor_msrc4.5MEDIUM
vendor_redhat4.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Vim vulnerability
vendor_ubuntu·2024-10-16
CVE-2024-43802 Vim vulnerability
Title: Vim vulnerability
Summary: Vim could be made to crash if it received specially crafted input.
USN-7048-1 fixed a vulnerability in Vim. This update provides the
corresponding update for Ubuntu 14.04 LTS.
Original advisory details:
Suyue Guo discovered that Vim incorrectly handled memory when flushing the
typeahead buffer, leading to heap-buffer-overflow. An attacker could
possibly use this issue to cause a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Vim vulnerability
vendor_ubuntu·2024-10-01
CVE-2024-43802 Vim vulnerability
Title: Vim vulnerability
Summary: Vim could be made to crash if it received specially crafted input.
Suyue Guo discovered that Vim incorrectly handled memory when flushing the
typeahead buffer, leading to heap-buffer-overflow. An attacker could
possibly use this issue to cause a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
vim: Heap Buffer Overflow in Vim's Typeahead Buffer Handling
vendor_redhat·2024-08-26·CVSS 4.5
CVE-2024-43802 [MEDIUM] CWE-122 vim: Heap Buffer Overflow in Vim's Typeahead Buffer Handling
vim: Heap Buffer Overflow in Vim's Typeahead Buffer Handling
Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush t
Microsoft
heap-buffer-overflow in ins_typebuf() in Vim < 9.1.0697
vendor_msrc·2024-08-13·CVSS 4.5
CVE-2024-43802 [MEDIUM] CWE-122 heap-buffer-overflow in ins_typebuf() in Vim < 9.1.0697
heap-buffer-overflow in ins_typebuf() in Vim Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.
Debian
CVE-2024-43802: vim - Vim is an improved version of the unix vi text editor. When flushing the typeahe...
vendor_debian·2024·CVSS 4.5
CVE-2024-43802 [MEDIUM] CVE-2024-43802: vim - Vim is an improved version of the unix vi text editor. When flushing the typeahe...
Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins
OSV
CVE-2024-43802: Vim is an improved version of the unix vi text editor
osv·2024-08-26·CVSS 4.5
CVE-2024-43802 [MEDIUM] CVE-2024-43802: Vim is an improved version of the unix vi text editor
Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins
No detection rules found.
No public exploits indexed.
2024-08-26
Published