CVE-2023-48235

What it actually does

An integer overflow occurs in Vim's ex address parsing when a negative line number causes LONG_MAX - lnum to overflow the existing bounds check, potentially leading to a crash.

Why it matters to the business

Users of the Vim editor may encounter unexpected crashes while editing files with certain relative address expressions, resulting in minor workflow interruptions and possible loss of unsaved changes. No ransomware or widespread exploitation has been observed.

How an attack unfolds

An attacker crafts input containing a relative ex address that produces a negative line number, then relies on the victim opening the file or running the command in an affected Vim version to trigger the flawed overflow check.

How to fix it

Upgrade to Vim release 9.0.2110 or the commit 060623e4a3bc72b011e7cd92bedb3bfb64e06200. No workarounds exist.

How to confirm the fix worked

Confirm the installed Vim version is 9.0.2110 or newer and test parsing of relative ex addresses that previously triggered negative line numbers.

Typical attack path

1. Craft malicious input with a relative ex address that evaluates to a negative line number.
2. Deliver the input via a file or command line that the target user opens or executes in Vim.
3. Trigger the address parsing code path that performs the flawed LONG_MAX subtraction.

How to detect it

Inspect system logs and crash reports for Vim process terminations that coincide with opening files containing ex commands.

What your security team should do

• Upgrade all Vim installations to the fixed version without delay.
• Replace older Vim binaries in build pipelines and container images.
• Review editor usage policies for environments handling untrusted files.