Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.
An attacker prepares a specially crafted file that immediately executes embedded code when opened in Vim. The mechanism relies on injecting an expression through the %{expr} sequence in the tabpanel configuration. The missing P_MLE flag means that this option is not restricted to command-line mode, allowing arbitrary expressions to be executed in the default editor configuration.
An attacker can execute arbitrary code on the victim's system (RCE) when opening a file, potentially taking control of the system with Vim process privileges. Due to the scope of impact (Scope: Changed), the consequences may extend beyond the editor process itself.
Vim should be updated to version 9.2.0272 or later. The patch is available in the official GitHub repository (tag v9.2.0272, commit 664701eb7576edb7c7c7d9f2d600815ec1f43459). Until updating, it is recommended to be cautious when opening files from untrusted sources.
Vim versions prior to 9.2.0272
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LVim
APPVim9.1.1390 – 9.2.0272 (excl.)
Related vulnerabilities
Buffer Overflow w VIM 8.1.2135 umożliwiający zdalne wykonanie kodu
Przepełnienie bufora na stercie (heap buffer overflow) w edytorze Vim
Heap-based Buffer Overflow w Vim — przepełnienie sterty przed wersją 8.2
Integer overflow w Vim podczas odczytu uszkodzonego pliku undo
Przepełnienie liczby całkowitej w Vim przy odczycie uszkodzonego pliku undo