Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade vim | Mar 21, 2024 | Oct 27, 2023 |
| Amazon Linux Ami 2 | — | Upgrade vim-debuginfoUpgrade xxdUpgrade vim-X11Upgrade vim-dataUpgrade vim-enhancedUpgrade vim-commonUpgrade vim-filesystemUpgrade vim-minimal | Nov 16, 2023 | Oct 27, 2023 |
| Amazon_linux | — | Upgrade vim | Dec 5, 2023 | Oct 27, 2023 |
| Amazon_linux_2023 | — | Upgrade vim-enhancedUpgrade xxdUpgrade vim-debugsourceUpgrade vim-enhanced-debuginfoUpgrade vim-minimal-debuginfoUpgrade xxd-debuginfoUpgrade vim-commonUpgrade vim-minimalUpgrade vim-debuginfoUpgrade vim-dataUpgrade vim-default-editorUpgrade vim-filesystem | Feb 17, 2025 | Oct 27, 2023 |
| Debian | — | Upgrade vimNo solution exists | May 15, 2025 | Oct 27, 2023 |
| Dell Powerstore Dsa2024120 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Mar 26, 2024 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade vim-commonUpgrade vim-filesystemUpgrade vim-minimalUpgrade vim-enhanced | Jan 10, 2024 | Oct 27, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade vim-enhancedUpgrade vim-filesystemUpgrade vim-commonUpgrade vim-minimal | Jan 29, 2024 | Oct 27, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade vim-filesystemUpgrade vim-commonUpgrade vim-enhancedUpgrade vim-minimal | Mar 13, 2024 | Oct 27, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade vim-filesystemUpgrade vim-commonUpgrade vim-minimalUpgrade vim-enhanced | Feb 12, 2024 | Oct 27, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 27, 2023 |
| Suse | — | Upgrade vim-data-commonUpgrade gvimUpgrade vim-dataUpgrade vimUpgrade vim-small | Nov 27, 2023 | Oct 27, 2023 |
| Ubuntu | — | Upgrade vim-gtk (Ubuntu Pro)Upgrade vim-noxUpgrade vim-gtk3 (Ubuntu Pro)Upgrade vim-tiny (Ubuntu Pro)Upgrade vim-nox (Ubuntu Pro)Upgrade vim-athenaUpgrade vim-gtkUpgrade xxd (Ubuntu Pro)Upgrade vimUpgrade vim-athena (Ubuntu Pro)Upgrade xxdUpgrade vim-gtk3Upgrade vim (Ubuntu Pro)Upgrade vim-tiny | Dec 19, 2023 | Oct 27, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 27, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub