CVE-2024-43790 heap-buffer-overflow in do_search() in Vim < 9.1.0689
A heap buffer overflow in Vim allows attackers to execute arbitrary code or cause a crash when specific search and display settings are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-43790?
CVE-2024-43790 is a medium-severity memory corruption vulnerability in Netapp Bootstrap Os, published on 22 Aug 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern is displayed at the bottom of the screen in a buffer (msgbuf). When right-left mode (:set rl) is enabled, the search pattern is reversed. This happens by allocating a new buffer. If the search pattern contains some ASCII NUL characters, the buffer allocated will be smaller than the original allocated buffer (because for allocating the reversed buffer, the strlen() function is called, which only counts until it notices an ASCII NUL byte ) and thus the original length indicator is wrong. This causes an overflow when accessing characters inside the msgbuf by the previously (now wrong) length of the msgbuf. The issue has been fixed as of Vim patch v9.1.0689.
Weakness: CWE-122
Which versions are affected by CVE-2024-43790?
It affects 2 products.
Products include Netapp Bootstrap Os, Vim Vim.
How do I fix CVE-2024-43790?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-43790 being exploited?
There is no known exploitation of CVE-2024-43790 in the wild and no public exploit code.
Other vulnerabilities in Netapp Bootstrap Os
- CVE-2024-43398 REXML denial of service vulnerability
- CVE-2025-30691 Security feature bypass in Oracle Java SE
- CVE-2025-29768 Vim vulnerable to potential data loss with zip.vim and special crafted zip files
- CVE-2024-39908 Denial of service in REXML
- CVE-2024-47814 use-after-free when closing buffers in Vim
Sources
Also known as ALPINE-CVE-2024-43790, BELL-CVE-2024-43790, DEBIAN-CVE-2024-43790, ECHO-5b33-f1a7-5161, GHSA-v2x2-cjcg-f9jm.