| Package | Affected versions | Patched versions |
|---|---|---|
| vim | < 9.2.0671 | 9.2.0671 |
Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free