Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags, but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647
CVSS Details
- CVSS 3.1 Base Score: 4.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade vim | Oct 1, 2024 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade vim-minimalUpgrade vim-debugsourceUpgrade vim-enhancedUpgrade xxdUpgrade vim-commonUpgrade vim-enhanced-debuginfoUpgrade vim-debuginfoUpgrade vim-default-editorUpgrade xxd-debuginfoUpgrade vim-minimal-debuginfoUpgrade vim-filesystemUpgrade vim-data | Feb 17, 2025 | Aug 1, 2024 |
| Apple Osx Vim | — | Upgrade macOS to the latest version | Oct 31, 2024 | Aug 1, 2024 |
| Debian | — | No solution existsUpgrade vim | May 15, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade vim-filesystemUpgrade vim-enhancedUpgrade vim-minimalUpgrade vim-common | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade vim-minimalUpgrade vim-enhancedUpgrade vim-commonUpgrade vim-filesystem | Oct 9, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade vim-filesystemUpgrade vim-commonUpgrade vim-minimalUpgrade vim-enhanced | Nov 5, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade vim-minimalUpgrade vim-enhancedUpgrade vim-filesystemUpgrade vim-common | Nov 11, 2024 | Aug 1, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 1, 2024 |
| Ubuntu | — | Upgrade vimUpgrade vim (Ubuntu Pro) | Sep 6, 2024 | Aug 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub