CVE-2023-0054: Vim Buffer Overflow Vulnerability

CVE-2023-0054 Overview

CVE-2023-0054 is an out-of-bounds write vulnerability in the Vim text editor, affecting versions prior to 9.0.1145. The flaw resides in the substitute expression handling logic within src/eval.c, where a recursive substitute expression can trigger invalid memory access. An attacker can exploit this issue by tricking a local user into opening a crafted file or executing a malicious substitute command. Successful exploitation can lead to memory corruption, application crash, or arbitrary code execution in the context of the user running Vim. The vulnerability is tracked under CWE-787: Out-of-bounds Write and was published to NVD on January 4, 2023.

Critical Impact
A crafted recursive substitute expression can corrupt memory in Vim, enabling local code execution with the privileges of the user opening the file.

Affected Products

Vim versions prior to 9.0.1145
Linux distributions shipping vulnerable Vim packages (Debian LTS, Gentoo)
Apple macOS releases bundling affected Vim builds

Discovery Timeline

2023-01-04 - CVE-2023-0054 published to NVD
2023-01-04 - Vim project releases patch 9.0.1145 via commit 3ac1d97a1d9353490493d30088256360435f7731
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2023-0054

Vulnerability Analysis

The vulnerability resides in Vim's substitute expression handling within src/eval.c. When Vim evaluates a substitute command with an expression replacement, the routine calls vim_regsub() to compute the replacement string length. The function can return a non-positive value when an inner recursive substitution invalidates intermediate state. Prior to the patch, the code did not validate the return value before performing buffer arithmetic with ga_grow(). The resulting length calculation produces an undersized allocation, and the subsequent write operates outside the bounds of the growarray.

The issue is exploitable through standard Vim workflows. A user opening a crafted text file or sourcing a malicious script that triggers the recursive substitute path can corrupt heap memory. Because Vim is widely deployed as the default editor on Unix-like systems, the attack surface includes administrators editing untrusted configuration files and developers reviewing third-party source.

Root Cause

The root cause is missing validation of the sublen return value from vim_regsub() before it is used in pointer arithmetic. When a recursive substitute expression returns a length less than or equal to zero, the unchecked value propagates into a ga_grow() size computation, producing an out-of-bounds write [CWE-787].

Attack Vector

Exploitation requires local access and user interaction. The attacker must persuade a target user to open a malicious file in Vim or evaluate a crafted substitute command. No network vector is required, and no elevated privileges are needed to trigger the flaw.

// Source: https://github.com/vim/vim/commit/3ac1d97a1d9353490493d30088256360435f7731
// Security patch in src/eval.c - patch 9.0.1145
	     * - The text after the match.
	     */
	    sublen = vim_regsub(®match, sub, expr, tail, 0, REGSUB_MAGIC);
+	    if (sublen <= 0)
+	    {
+		ga_clear(&ga);
+		break;
+	    }
	    if (ga_grow(&ga, (int)((end - tail) + sublen -
			    (regmatch.endp[0] - regmatch.startp[0]))) == FAIL)
	    {

The patch adds an explicit check that aborts the loop and clears the growarray when vim_regsub() returns a non-positive length, preventing the out-of-bounds write.

Detection Methods for CVE-2023-0054

Indicators of Compromise

Unexpected Vim process crashes or segmentation faults referencing vim_regsub or ga_grow in core dumps
Vim spawning child processes such as /bin/sh or shells immediately after opening an untrusted file
Editor sessions terminating abnormally when users source unfamiliar .vimrc fragments or modeline-laden files

Detection Strategies

Inventory installed Vim binaries across endpoints and compare reported versions against 9.0.1145 or distribution-patched equivalents
Hunt for crash artifacts (core.*, journald entries, dmesg segfault messages) attributed to the vim binary
Monitor execve telemetry for Vim processes launching unexpected subprocesses, which can indicate post-exploitation code execution

Monitoring Recommendations

Enable auditd rules to log execve calls for the vim and vi binaries on multi-user systems
Forward Vim crash reports and segfault syslog entries to a centralized logging platform for retrospective analysis
Track package management events that install or downgrade Vim to versions older than 9.0.1145

How to Mitigate CVE-2023-0054

Immediate Actions Required

Upgrade Vim to version 9.0.1145 or later on all systems where the editor is installed
Apply vendor-supplied package updates from Debian LTS, Gentoo (GLSA 202305-16), and Apple (HT213670)
Audit shared development hosts and build servers where users routinely open untrusted source files in Vim

Patch Information

The upstream fix is available in Vim commit 3ac1d97a, included in release 9.0.1145. Distribution patches are tracked in the Debian LTS announcement and the March 2025 Debian LTS update. Additional disclosure context is published on the Huntr bounty report and the Full Disclosure mailing list.

Workarounds

Avoid opening untrusted text files in Vim until the package is updated
Disable modelines globally by setting set nomodeline in /etc/vim/vimrc to reduce automatic command execution from file metadata
Use a hardened minimal editor such as nano for inspecting files from unknown origins on unpatched hosts

bash

# Verify installed Vim version meets the patched baseline
vim --version | head -n 1

# Debian / Ubuntu: apply distribution security updates
sudo apt-get update && sudo apt-get install --only-upgrade vim vim-common vim-runtime

# Gentoo: rebuild to the patched ebuild per GLSA 202305-16
sudo emerge --ask --oneshot --verbose ">=app-editors/vim-9.0.1145"

# Temporary hardening: disable modelines system-wide
echo 'set nomodeline' | sudo tee -a /etc/vim/vimrc