Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade vim | Mar 21, 2024 | Oct 27, 2023 |
| Amazon Linux Ami 2 | — | Upgrade vim-filesystemUpgrade vim-minimalUpgrade vim-commonUpgrade vim-dataUpgrade vim-enhancedUpgrade vim-debuginfoUpgrade xxdUpgrade vim-X11 | Nov 16, 2023 | Oct 27, 2023 |
| Amazon_linux | — | Upgrade vim | Dec 5, 2023 | Oct 27, 2023 |
| Amazon_linux_2023 | — | Upgrade vim-minimal-debuginfoUpgrade vim-enhancedUpgrade vim-enhanced-debuginfoUpgrade xxdUpgrade xxd-debuginfoUpgrade vim-debugsourceUpgrade vim-minimalUpgrade vim-filesystemUpgrade vim-commonUpgrade vim-dataUpgrade vim-default-editorUpgrade vim-debuginfo | Feb 17, 2025 | Oct 27, 2023 |
| Debian | — | Upgrade vimNo solution exists | May 15, 2025 | Oct 27, 2023 |
| Dell Powerstore Dsa2024120 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Mar 26, 2024 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade vim-minimalUpgrade vim-filesystemUpgrade vim-enhancedUpgrade vim-common | Jan 10, 2024 | Oct 27, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade vim-commonUpgrade vim-minimalUpgrade vim-filesystemUpgrade vim-enhanced | Jan 29, 2024 | Oct 27, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade vim-minimalUpgrade vim-enhancedUpgrade vim-filesystemUpgrade vim-common | Mar 13, 2024 | Oct 27, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade vim-filesystemUpgrade vim-commonUpgrade vim-enhancedUpgrade vim-minimal | Feb 12, 2024 | Oct 27, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 27, 2023 |
| Suse | — | Upgrade vimUpgrade vim-dataUpgrade vim-data-commonUpgrade vim-smallUpgrade gvim | Nov 27, 2023 | Oct 27, 2023 |
| Ubuntu | — | Upgrade vim-gtkUpgrade xxdUpgrade vimUpgrade xxd (Ubuntu Pro)Upgrade vim-athena (Ubuntu Pro)Upgrade vim-tinyUpgrade vim (Ubuntu Pro)Upgrade vim-gtk3Upgrade vim-noxUpgrade vim-gtk (Ubuntu Pro)Upgrade vim-tiny (Ubuntu Pro)Upgrade vim-gtk3 (Ubuntu Pro)Upgrade vim-athenaUpgrade vim-nox (Ubuntu Pro) | Dec 19, 2023 | Oct 27, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 27, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub