CyberRota Analysis
AI-GeneratedVim versions from 9.2.0511 to 9.2.0844 are vulnerable due to a flaw in the json_decode_item() function, which can lead to reading freed memory when processing invalid JSON strings. This can potentially result in unexpected behavior or crashes during text editing operations. Users and administrators of affected Vim versions should prioritize updating to version 9.2.0844 to mitigate any risks associated with this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.