CVE-2008-3432

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-10-10 · updated 2026-06-16
Weakness: CWE-119

Description

Heap-based buffer overflow in the mch_expand_wildcards function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames, as demonstrated by the netrw.v3 test case.

Affected products

vim/vim: 6.2, 6.3

References

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
http://secunia.com/advisories/32222
http://secunia.com/advisories/32858
http://secunia.com/advisories/33410
http://support.apple.com/kb/HT3216
http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm
http://www.openwall.com/lists/oss-security/2008/07/15/4
http://www.openwall.com/lists/oss-security/2008/08/01/1
http://www.redhat.com/support/errata/RHSA-2008-0617.html
http://www.securityfocus.com/archive/1/502322/100/0/threaded

Get alerted when CVE-2008-3432 or the next vulnerability affects your stack