CVE-2023-46246

What it actually does

Heap-use-after-free triggered when an oversized argument to the :history command causes an integer overflow in ga_grow_inner (alloc.c:748), the allocation is freed in do_cmdline (ex_docmd.c:1010), and the dangling pointer is later dereferenced in cmdhist.c:759.

Why it matters to the business

Local users editing files with Vim may experience editor crashes, leading to lost work and interrupted editing sessions; widespread use of Vim in developer and operations environments amplifies operational friction but does not enable remote code execution or data theft.

How an attack unfolds

An attacker with local access supplies a specially crafted numeric argument to the :history command that overflows the accepted size, resulting in the use-after-free condition and a crash; no remote vector or privilege escalation is involved.

How to fix it

Upgrade vim/vim to commit 9198c1f2b1ddecde22af918541e0de2a32f0f45a or later; rebuild from source or obtain a package containing the fix; until updated, avoid using the :history command with untrusted numeric arguments.

How to confirm the fix worked

Confirm the installed Vim reports version 9.0.2068 or newer (or contains commit 9198c1f2b1ddecde22af918541e0de2a32f0f45a); attempt the :history command with a large numeric argument and verify no crash occurs.

Typical attack path

1. Obtain local shell access to a system running an affected Vim build
2. Invoke vim and enter command-line mode
3. Execute :history with an integer argument large enough to trigger the overflow
4. Observe editor crash due to the dangling pointer dereference

How to detect it

Review system logs and crash reports for Vim segmentation faults occurring immediately after :history command usage; correlate with user shell history files containing suspicious :history invocations.

What your security team should do

• Prioritize patching developer workstations and build servers that use Vim
• Add Vim to the organization's patch-management inventory with the fixed commit as the target
• Monitor upstream Vim releases for any follow-on corrections