CVE-2023-48706

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.0.2121

Description The issue is related to a heap-use-after-free vulnerability. When executing a :s command for the first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive :s call causes free-ing of memory which may later be accessed by the initial :s command. The user must intentionally execute the payload, and the process is tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim.

Recommendations For versions prior to 9.0.2121, update to version 9.0.2121 or later to resolve the issue. As a temporary workaround, consider avoiding the use of sub-replace-special atoms inside the substitution part of the :s command until a patch is applied.