CVE-2023-48706

Summary

CVE-2023-48706 is a heap-use-after-free vulnerability affecting Vim, a popular UNIX editor. This issue arises when executing a `:s` command with a sub-replace-special atom in the substitution part for the very first time. A recursive `:s` call may occur, resulting in memory being freed and later accessed by the initial `:s` command. This can potentially lead to unintended behavior, including a crash of Vim. To exploit this vulnerability, a user must intentionally execute the payload, making it a bit tricky to exploit. Version 9.0.2121 of Vim includes a fix for this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.