Use After Free in GitHub repository vim/vim prior to 9.0.1858.

Use After Free in GitHub repository vim/vim prior to 9.0.0246.

Use After Free in GitHub repository vim/vim prior to 9.0.1857.

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.

Use After Free in GitHub repository vim/vim prior to 9.0.0213.

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.

Use After Free in GitHub repository vim/vim prior to 9.0.0322.

Use After Free in GitHub repository vim/vim prior to 9.0.0225.

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

Use After Free in GitHub repository vim/vim prior to 8.2.

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

Use After Free in GitHub repository vim/vim prior to 8.2.

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Use After Free in GitHub repository vim/vim prior to 9.0.0789.

Use After Free in GitHub repository vim/vim prior to 9.0.0490.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968.

Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.

Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

vim is vulnerable to Heap-based Buffer Overflow

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.

vim is vulnerable to Heap-based Buffer Overflow

vim is vulnerable to Heap-based Buffer Overflow

vim is vulnerable to Heap-based Buffer Overflow

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969.

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102.

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003

Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100.

Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. Back then we assumed this loop is unnecessary. However, this change made it possible that the cursor position stays invalid and points beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at the specified cursor position. It's not quite clear yet, what can lead to this situation that the cursor points to an invalid position. That's why patch v9.1.0707 does not include a test case. The only observed impact has been a program crash. This issue has been addressed in with the patch v9.1.0707. All users are advised to upgrade.

Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern is displayed at the bottom of the screen in a buffer (msgbuf). When right-left mode (:set rl) is enabled, the search pattern is reversed. This happens by allocating a new buffer. If the search pattern contains some ASCII NUL characters, the buffer allocated will be smaller than the original allocated buffer (because for allocating the reversed buffer, the strlen() function is called, which only counts until it notices an ASCII NUL byte ) and thus the original length indicator is wrong. This causes an overflow when accessing characters inside the msgbuf by the previously (now wrong) length of the msgbuf. The issue has been fixed as of Vim patch v9.1.0689.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

vim is vulnerable to Heap-based Buffer Overflow

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.