CVE-2024-43802

What it actually does

Heap-buffer overflow in typeahead buffer handling: flushing moves tb_off outside the valid size of the typebuf variable, allowing later writes in ins_typebuf() to corrupt adjacent heap memory.

Why it matters to the business

Rare crashes in the Vim editor that can interrupt editing sessions; exploitation is difficult and requires specific long mappings plus error conditions, resulting in limited operational impact for most users.

How an attack unfolds

An attacker supplies a crafted set of long key mappings that, when combined with error messages forcing a typeahead buffer flush, advances the internal offset beyond the buffer bounds and triggers a heap overflow on subsequent input processing.

How to fix it

Upgrade Vim to the commit 322ba9108612bead5eb7731ccb66763dec69ef1b (patch v9.1.0697) or later; no workarounds exist.

How to confirm the fix worked

Verify the installed Vim binary reports a version containing commit 322ba9108612bead5eb7731ccb66763dec69ef1b or newer; test that the described mapping-plus-error sequence no longer causes a crash.

Typical attack path

1. Define multiple long key mappings in Vim configuration
2. Trigger conditions that generate error messages (e.g., invalid commands)
3. Cause Vim to flush the typeahead buffer
4. Advance tb_off beyond allocated buffer size
5. Induce heap-buffer overflow in ins_typebuf leading to crash

How to detect it

Review application logs or core dumps for Vim crashes occurring shortly after error messages while long mappings are active; no public exploitation artifacts are known.

What your security team should do

• Prioritize upgrade of Vim installations to the fixed commit within normal patch cycles
• Monitor upstream Vim releases for any follow-on corrections
• Include Vim version checks in standard software inventory and update processes