CVE-2023-4735: Vim Buffer Overflow Vulnerability

CVE-2023-4735 Overview

CVE-2023-4735 is an out-of-bounds write vulnerability [CWE-787] in the Vim text editor affecting versions prior to 9.0.1847. The flaw resides in the do_addsub() function in src/ops.c, which handles increment and decrement operations on numeric values. When processing binary number conversions, the loop writing characters into the buf2 buffer lacks bounds checking against NUMBUFLEN. An attacker can craft a malicious file that triggers memory corruption when opened by a user in Vim. Apple shipped the fix in macOS as part of a security update referenced in HT213984.

Critical Impact
Successful exploitation can corrupt adjacent memory, leading to local code execution in the context of the Vim user, with high impact to confidentiality, integrity, and availability.

Affected Products

Vim versions prior to 9.0.1847
Apple macOS 14.1 (Sonoma) bundled Vim builds
Linux and BSD distributions packaging vulnerable Vim releases

Discovery Timeline

2023-09-02 - CVE-2023-4735 published to the National Vulnerability Database (NVD)
2023-09-02 - Vendor patch committed to the vim/vim GitHub repository (commit 889f6af)
2023-10 - Full Disclosure mailing list post detailing the issue
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-4735

Vulnerability Analysis

The vulnerability exists in the do_addsub() function in src/ops.c, which is invoked when Vim increments or decrements a number under the cursor. When the value is a binary number, Vim walks each bit and writes either '0' or '1' into the stack buffer buf2. The original loop terminates only when bit reaches zero, without checking whether the index i remains within NUMBUFLEN. A specially crafted buffer containing a large binary literal forces the loop to write past the end of buf2, producing a stack-based out-of-bounds write [CWE-787]. Because exploitation requires the victim to open a malicious file or buffer in Vim, the attack vector is local and user interaction is required.

Root Cause

The root cause is a missing upper-bound check on the write index relative to the destination buffer size. The patched code adds the constraint i < (NUMBUFLEN - 1) to the loop condition, ensuring the index cannot exceed the allocated buffer minus the null terminator slot.

Attack Vector

An attacker delivers a crafted text file containing a binary numeric literal designed to drive the loop past NUMBUFLEN bytes. The victim opens the file in Vim and performs an increment or decrement operation (for example, Ctrl-A or Ctrl-X) on the binary value. Memory adjacent to buf2 is overwritten, which can corrupt stack metadata and lead to arbitrary code execution in the user's context.

// Security patch from src/ops.c (patch 9.0.1847)
 	    for (bit = bits; bit > 0; bit--)
 		if ((n >> (bit - 1)) & 0x1) break;
 
-	    for (i = 0; bit > 0; bit--)
+	    for (i = 0; bit > 0 && i < (NUMBUFLEN - 1); bit--)
 		buf2[i++] = ((n >> (bit - 1)) & 0x1) ? '1' : '0';
 
 	    buf2[i] = '\0';
// Source: https://github.com/vim/vim/commit/889f6af37164775192e33b233a90e86fd3df0f57

The patch adds the bounds check i < (NUMBUFLEN - 1) so that the loop stops before writing beyond the buffer.

Detection Methods for CVE-2023-4735

Indicators of Compromise

Unexpected crashes or stack-smashing aborts produced by the vim process when opening untrusted files.
Core dumps or crash telemetry referencing do_addsub in the vim binary.
Vim binaries on disk reporting a version string lower than 9.0.1847 via vim --version.

Detection Strategies

Inventory installed Vim versions across endpoints and flag any installation below 9.0.1847.
Monitor for vim process termination signals such as SIGABRT or SIGSEGV correlated with the opening of files from email, downloads, or removable media.
Use file-content telemetry to flag text files containing extremely long binary literals that target the do_addsub() code path.

Monitoring Recommendations

Forward endpoint crash and process-exit events to a centralized SIEM or data lake for correlation against Vim version data.
Track package manager events (apt, dnf, brew, Apple software updates) to confirm that the 9.0.1847 or vendor-equivalent patch is deployed.
Audit shared development hosts and CI runners where Vim is commonly invoked on attacker-controlled input.

How to Mitigate CVE-2023-4735

Immediate Actions Required

Upgrade Vim to 9.0.1847 or later on all Linux, BSD, and Windows endpoints.
Apply Apple's macOS security update referenced in Apple Support Article HT213984 to remediate the bundled Vim build.
Avoid opening untrusted text files in Vim until patches are applied, and disable automated Vim processing of unvetted input in scripts or pipelines.

Patch Information

The fix is committed in the vim/vim repository and shipped as patch 9.0.1847. Additional context is available in the Huntr Bounty Report and the Full Disclosure Mailing List Post. macOS users receive the fix through Apple's bundled update.

Workarounds

Restrict use of Vim's increment and decrement commands (Ctrl-A, Ctrl-X) on files from untrusted sources until patches are applied.
Use an alternative editor for inspecting suspicious files when an updated Vim build is not yet available.
Enforce least-privilege user accounts so that successful exploitation does not yield elevated system access.

bash

# Verify the installed Vim version meets the patched baseline
vim --version | head -n 2

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade vim vim-common vim-runtime

# RHEL/Fedora
sudo dnf upgrade vim-enhanced vim-common vim-minimal

# macOS (Homebrew build)
brew update && brew upgrade vim

# macOS (system Vim) - apply the relevant Apple security update
softwareupdate -l && softwareupdate -i -a