Executive brief
Vim is a widely-used command-line text editor that supports network communication through sockets. A flaw in its JSON parsing code allows an attacker to read freed memory by sending a specially crafted JSON string over the network, potentially exposing sensitive data that was recently freed from memory.
Technical details
The vulnerability is a use-after-free in json_decode_item() (src/json.c), where a cached pointer to the read buffer can become stale after json_decode_string() calls channel_fill() to refill and free the current buffer. When an invalid JSON string spans multiple buffer refills (e.g., with an invalid \u escape sequence), the error handler passes the dangling pointer to semsg(), causing a read of freed memory. This is reachable pre-authentication through Vim's socket server. The bug affects versions 9.2.0511 through 9.2.0843 and was fixed in version 9.2.0844 by using the current reader's position instead of the cached pointer.
Affected products
- Vim Vim 9.2.0511 to 9.2.0843
Timeline
- 2026-08-11: disclosed
- 2026-07-24: patched: Version 9.2.0844 released