Description
Heap-based buffer overflow in the mch_expand_wildcards function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames, as demonstrated by the netrw.v3 test case.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | vim +4 | 1:6.3.046-1.el4_7.5z | RHSA-2008:0617 |
| RHEL 3 | vim +4 | 1:6.3.046-0.30E.11 | RHSA-2008:0617 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Vim - 'mch_expand_wildcards()' Heap Buffer Overflow EDB-32225 · remote · Jan 29, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2008:0617 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://www.vmware.com/security/advisories/VMSA-2009-0004.html
- [oss-security] 20080715 Re: Re: More arbitrary code executions in Netrw mailing-list
- 31681 vdb-entry
- 32858 third-party-advisory
- 33410 third-party-advisory
- [oss-security] 20080731 Re: Re: More arbitrary code executions in Netrw mailing-list
- http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm
- ADV-2009-0904 vdb-entry
- ADV-2009-0033 vdb-entry
- oval:org.mitre.oval:def:11203 vdb-entry signature
- oval:org.mitre.oval:def:5987 vdb-entry signature
- 20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim mailing-list
- 32222 third-party-advisory
- vim-mchexpandwildcards-bo(44722) vdb-entry
- 30648 vdb-entry
- ADV-2008-2780 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=455455
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- RHSA-2008:0617 vendor-advisory