CVE-2024-43802

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-43802", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-08-16T14:20:37.326Z", "datePublished": "2024-08-26T18:48:11.979Z", "dateUpdated": "2025-11-03T20:38:52.392Z"}, "containers": {"cna": {"title": "heap-buffer-overflow in ins_typebuf() in Vim < 9.1.0697", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh"}, {"name": "https://github.com/vim/vim/commit/322ba9108612bead5eb", "tags": ["x_refsource_MISC"], "url": "https://github.com/vim/vim/commit/322ba9108612bead5eb"}], "affected": [{"vendor": "vim", "product": "vim", "versions": [{"version": "< 9.1.0697", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-26T18:48:11.979Z"}, "descriptions": [{"lang": "en", "value": "Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue."}], "source": {"advisory": "GHSA-4ghr-c62x-cqfh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-28T14:28:07.231057Z", "id": "CVE-2024-43802", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T14:28:30.371Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20241004-0008/"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:38:52.392Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20241004-0008/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-10-04T15:02:49.926Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43802", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-28T14:28:07.231057Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T14:28:22.880Z"}}], "cna": {"title": "heap-buffer-overflow in ins_typebuf() in Vim < 9.1.0697", "source": {"advisory": "GHSA-4ghr-c62x-cqfh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "vim", "product": "vim", "versions": [{"status": "affected", "version": "< 9.1.0697"}]}], "references": [{"url": "https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh", "name": "https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/vim/vim/commit/322ba9108612bead5eb", "name": "https://github.com/vim/vim/commit/322ba9108612bead5eb", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-26T18:48:11.979Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43802", "state": "PUBLISHED", "dateUpdated": "2024-10-04T15:02:49.926Z", "dateReserved": "2024-08-16T14:20:37.326Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-08-26T18:48:11.979Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "vim", "vendor": "vim", "versions": [{"status": "affected", "version": "< 9.1.0697"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue."}, {"lang": "es", "value": "Vim es una versi\u00f3n mejorada del editor de texto Unix VI. Al vaciar el b\u00fafer de escritura anticipada, Vim mueve la posici\u00f3n actual en el b\u00fafer de escritura anticipada pero no verifica si queda suficiente espacio en el b\u00fafer para manejar los siguientes caracteres. Por lo tanto, esto puede llevar a que la posici\u00f3n tb_off dentro de la variable typebuf apunte fuera del tama\u00f1o de b\u00fafer v\u00e1lido, lo que luego puede provocar un desbordamiento del b\u00fafer de mont\u00f3n, por ejemplo, en ins_typebuf(). Por lo tanto, al vaciar el b\u00fafer de escritura anticipada, verifique si queda suficiente espacio antes de avanzar a la posici\u00f3n de apagado. De lo contrario, recurra para vaciar el contenido actual de Typebuf. A\u00fan no est\u00e1 del todo claro qu\u00e9 puede conducir a esta situaci\u00f3n. Parece suceder cuando aparecen mensajes de error (lo que har\u00e1 que Vim vac\u00ede el b\u00fafer de escritura anticipada) en combinaci\u00f3n con varios mappgins largos y, por lo tanto, eventualmente puede mover la posici\u00f3n de apagado fuera de un tama\u00f1o de b\u00fafer v\u00e1lido. El impacto es bajo ya que no es f\u00e1cilmente reproducible y requiere tener varias asignaciones activas y ejecutar alguna condici\u00f3n de error. Pero cuando esto sucede, provocar\u00e1 un bloqueo. El problema se solucion\u00f3 a partir del parche Vim v9.1.0697. Se recomienda a los usuarios que actualicen. No se conocen workarounds para este problema."}], "id": "CVE-2024-43802", "lastModified": "2026-06-17T07:51:44.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-43802", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-08-28T14:28:07.231057Z", "version": "2.0.3"}}]}, "published": "2024-08-26T19:15:07.943", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/vim/vim/commit/322ba9108612bead5eb"}, {"source": "security-advisories@github.com", "url": "https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20241004-0008/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vim: Heap Buffer Overflow in Vim's Typeahead Buffer Handling", "id": "2307995", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2307995"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-122", "details": ["Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue.", "A flaw was found in Vim. This issue may allow a heap-buffer overflow via improper management of the typeahead buffer, leading to crashes when error messages occur in combination with several long mappings."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-43802", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2024-08-26T19:15:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-43802\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-43802\nhttps://github.com/vim/vim/commit/322ba9108612bead5eb\nhttps://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh"], "threat_severity": "Low"}

{"created": "2025-07-13T11:22:20.321043+00:00", "updated": "2025-07-13T11:22:20.321129+00:00", "vendors": ["vim", "vim$PRODUCT$vim"]}