Vim’s Partial Patch Problem: 14+ Heap Overflows Left Behind After CVE-2026–28421

FengNing_Architect

Follow

6 min read

·

6 hours ago

Listen

Share

Feng Ning · Innora Security Research · April 2026

TL;DR

• What: CVE-2026–28421 fixed ONE (int) cast truncation in viminfo.c. At least 14 identical truncations remain across ex_getln.c, memline.c, terminal.c, session.c, and others.
• Impact: CWE-190 (Integer Overflow) → CWE-122 (Heap Buffer Overflow). Attackable via crafted swap files, undo files, session files, and terminal output — all reachable through git repositories and shared filesystems.
• Response: Vim’s lead maintainer closed the GitHub Security Advisory and threatened to ban the reporter.
• Fix: Trivial — remove the redundant (int) casts. alloc() already accepts size_t.

The Vulnerability Pattern

Vim’s alloc() accepts size_t. But many call sites cast to (int) first:

alloc_cmdbuff((int)len);   // src/ex_getln.c:1540

Exceeding INT_MAX (2³¹ − 1, roughly 2.1 billion) triggers silent truncation — the upper bits are discarded:

size_t len = 0x100000010;   // 4,294,967,312 (4 GB + 16)
int  ilen  = (int)len;      // 16 — upper 33 bits discarded
alloc(ilen);                // allocates 16 bytes
memcpy(buf, data, len);     // copies 4 GB into a 16-byte buffer
                            // → heap buffer overflow