CVE-2024-22667

What it actually does

Stack-based buffer overflow in did_set_langmap in map.c due to unsafe sprintf writes to an error buffer passed to option callback functions, enabling memory corruption that may lead to arbitrary code execution or crashes.

Why it matters to the business

Local attackers could gain code execution on developer or server systems using vulnerable Vim, resulting in unauthorized access, data exposure, or disruption of editing and automation workflows.

How an attack unfolds

An attacker with local access supplies crafted input or configuration that triggers the langmap option callback, causing sprintf to overflow the stack buffer and corrupt adjacent memory for control-flow hijacking.

How to fix it

Upgrade Vim to the version containing commit b39b240c386a5a29241415541f1c99e2e6b8ce47 or later.

How to confirm the fix worked

Confirm Vim version 9.0.2142 or newer and verify presence of the fixing commit in the source.

Typical attack path

1. Obtain local access or user privileges on the target system
2. Craft malicious langmap value or configuration that invokes the vulnerable option path
3. Trigger did_set_langmap through normal option processing or startup
4. Leverage overflow to execute arbitrary code or crash the process

How to detect it

Inspect system and application logs for Vim segmentation faults or abnormal terminations; review command history and configuration files for suspicious langmap settings.

What your security team should do

• Immediately update all Vim installations to the fixed commit
• Limit local user privileges on systems where Vim runs with elevated access
• Review and harden vimrc and environment configurations for untrusted input