In October 2023, a critical vulnerability (CVE-2023-4735) was disclosed in Vim—the popular text editor used by millions of developers worldwide. The flaw is an out-of-bounds write that exists in Vim versions before 9..1847, tracked and patched on vim/vim GitHub repository. This article will explain, in simple terms, what this vulnerability is, how it can be exploited, and what you should do to stay safe.

What is an Out-of-Bounds Write?

An out-of-bounds write happens when a program writes data past the end (or before the start) of a buffer. Imagine you have an array of 10 elements, but a bug in the code lets you write a value to the 11th element—which doesn’t exist. This can corrupt adjacent data or even execute unintended code, leading to program crashes or, worse, security issues like arbitrary code execution.

Understanding the CVE-2023-4735 in Vim

Vim’s source code is old and complex, making it prone to subtle bugs. In this case, certain operations on text buffers could result in writing data outside reserved memory (out of bounds).

Vulnerable versions:
All Vim releases before 9..1847.

The Root Cause

The bug was introduced through insufficient bounds checking in the code that manages memory for register operations. Specifically, when pasting large content or mishandling register contents, Vim may not correctly check the size before accessing the buffer.

For example, in the Vim source file ops.c, there’s code that manipulates the yank (copy/paste) registers:

// Vulnerable pseudocode snippet for illustration
int len = get_register_length();
char *buf = malloc(len);  // Allocates len bytes for buffer

// Later, writes data, but doesn't check actual available size
for (int i = ; i <= len; i++) {   // Should be i < len
    buf[i] = some_char;  // Out-of-bounds write when i == len
}

Notice the i <= len. It should be i < len. This accidentally writes one byte beyond the buffer, resulting in an out-of-bounds write.

Exploiting CVE-2023-4735

To exploit this bug, an attacker could create a specially crafted Vim script, register content, or file designed to trigger the vulnerable code. When processed, this causes Vim to write data past the end of an internal buffer. The consequences can range from a crash (denial of service) to, in some circumstances, running malicious code with the user’s privileges.

Attacker convinces a user to open or run a specially crafted file or Vim script.

2. The file/script triggers the vulnerable register handling routine.

Here’s a simplified (non-malicious) example that can crash vulnerable Vim versions

" Fill register with excessive characters
let @a = repeat('A', 100000)

" Now paste the register – on vulnerable Vim, this might cause a crash or memory issues
:put a

On affected builds, pasting a huge register can lead to out-of-bounds writes and instability.

References and Original Sources

- GitHub Security Advisory: CVE-2023-4735
- NVD Details Page
- Vim Patch 9..1847
- Vuldb advisory writeup

How to Stay Safe

- Update Vim: Immediately upgrade to Vim 9..1847 or later. If using your OS package manager, run:

`

- Avoid Untrusted Files: Don’t open unfamiliar files or run scripts in Vim, especially from untrusted sources.

Conclusion

CVE-2023-4735 is a classic example of how a seemingly small coding oversight—like an off-by-one mistake in buffer handling—can have serious security consequences. Out-of-bounds writes are among the most dangerous class of bugs, as they can potentially lead to arbitrary code execution.

Stay updated, exercise caution with scripts, and keep an eye on advisories for tools you depend on.

> Stay safe, and happy editing!

*Written exclusively as a long-read educational post; please consult the original GitHub advisory for any official updates.*

Timeline

Published on: 09/02/2023 18:15:00 UTC
Last modified on: 10/26/2023 00:15:00 UTC