Vim patches out-of-bounds write in bundled libvterm resize handling
Before 9.2.1013, huge terminal resize requests updated state but not clamped screen storage, so later output could write past the buffer.
Vim releases before 9.2.1013 carried a medium-severity out-of-bounds write in the bundled libvterm terminal emulator, according to maintainer Christian Brabandt.
A program inside a Vim terminal can request a new size with a CSI resize sequence. Numeric arguments on that path can run to roughly a billion. The terminal state stored the requested rows and columns unchanged and widened its scroll region to match. Screen storage, by contrast, clamps allocations to 1000 rows and 1000 columns and never feeds the clamped size back into the state.
After a request for tens of thousands of rows, later bound checks still trusted the oversized dimensions. Line feeds stopped scrolling at the real bottom of the screen and only advanced the cursor. Ordinary text output that wrapped or printed past the true allocation could therefore read and write past the end of the line buffers.
The issue is classed as an out-of-bounds write with improper validation of input quantity. A CVE has been requested but is not yet assigned. Updating to Vim 9.2.1013 or later closes the gap.