Vim NFA 正则引擎中 NULL 指针解引用漏洞影响版本

Vim NFA 正则引擎中 NULL 指针解引用漏洞影响版本 < 9.2.0137
好的，我现在需要帮用户总结这篇文章的内容。用户的要求是用中文，控制在100字以内，不需要特定的开头，直接写描述。首先，我看看文章的主要内容。这篇文章讨论的是Vim中的一个安全漏洞，具体是在NFA正则表达式引擎中发现了一个空指针解引用的问题。这个漏洞影响了Vim版本小于9.2.0137的用户。接下来，我需要提取关键信息：漏洞类型是空指针解引用（CWE-476），严重程度为中等。问题出现在处理包含组合Unicode字符的正则表达式时，导致NFA后缀栈损坏，进而引发段错误。然后，漏洞的影响范围包括所有可以向Vim提供正则表达式的用户和进程，比如插件或命令行参数。修复已经发布在9.2.0137版本中，并且提到了致谢和参考链接。现在，我需要将这些信息浓缩到100字以内。要确保涵盖漏洞类型、影响范围、触发条件以及修复情况。最后，组织语言，确保简洁明了。可能的结构是：Vim版本问题、漏洞类型、触发条件、影响范围和修复情况。总结一下：Vim <9.2.0137版本中存在NFA正则表达式引擎空指针解引用漏洞，处理包含组合Unicode字符的正则时触发，导致崩溃。已修复。 </think> Vim <9.2.0137版本中发现NFA正则表达式引擎空指针解引用漏洞，处理包含组合Unicode字符的正则时触发段错误。已修复。 2026-3-11 19:8:0 Author: seclists.org(查看原文) 阅读量:1 收藏

oss-sec mailing list archives

From: Christian Brabandt <cb () 256bit org>
Date: Wed, 11 Mar 2026 20:05:04 +0100



NFA regex engine NULL pointer dereference affects Vim < 9.2.0137
================================================================
Date: 11.03.2026
Severity: Moderate
CVE: *not-yet-assigned*
CWE: NULL Pointer Dereference (CWE-476)

## Summary

A NULL pointer dereference occurs in `nfa_max_width()` when the NFA regex
engine processes a look-behind assertion containing a collection with a
combining Unicode character as a range endpoint.

## Description

Vim's NFA regex compiler, when encountering a collection containing a
combining character as the endpoint of a character range (e.g.
`[0-0\u05bb]`), incorrectly emits the composing bytes of that character
as separate NFA states. This corrupts the NFA postfix stack, resulting in
`NFA_START_COLL` having a NULL `out1` pointer. When `nfa_max_width()`
subsequently traverses the compiled NFA to estimate match width for the
look-behind assertion, it dereferences `state->out1->out` without a NULL
check, causing a segmentation fault.

The bug was introduced by patch [9.1.0011](https://github.com/vim/vim/commit/d2cc51f9a1a5a30ef5d2e732f49d7f495cae24cf).

## Impact

Any user or process that can supply a regex pattern to Vim - including via
plugins or command-line arguments - can trigger a crash.

## Acknowledgements

The Vim project would like to thank  Nathan Mills for identifying the
vulnerability through fuzzing and providing a minimal reproducer and detailed analysis.

## References

The issue has been fixed as of Vim patch [v9.2.0137](https://github.com/vim/vim/releases/tag/v9.2.0137)
- [Commit](https://github.com/vim/vim/commit/36d6e87542cf823d833e451e09a90ee429899cec)
- [GitHub Advisory](https://github.com/vim/vim/security/advisories/GHSA-9phh-423r-778r)

Thanks,
Christian
-- 
Nun kommt es im Leben darauf an, wer eine Wahrheit ausspricht. In
gewissen Munde wird auch Wahrheit zu Lüge.
                -- Thomas Mann

Current thread:

[vim-security] NFA regex engine NULL pointer dereference affects Vim < 9.2.0137 Christian Brabandt (Mar 11)

文章来源: https://seclists.org/oss-sec/2026/q1/296
如有侵权请联系:admin#unsafe.sh