Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-vim | Mar 21, 2024 | Oct 27, 2023 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-vim-commonamazon-linux-ami-2-upgrade-vim-dataamazon-linux-ami-2-upgrade-vim-debuginfoamazon-linux-ami-2-upgrade-vim-enhancedamazon-linux-ami-2-upgrade-vim-filesystemamazon-linux-ami-2-upgrade-vim-minimalamazon-linux-ami-2-upgrade-vim-x11amazon-linux-ami-2-upgrade-xxd | Nov 16, 2023 | Oct 27, 2023 | |
| Amazon_linux | — | amazon-linux-upgrade-vim | Dec 5, 2023 | Oct 27, 2023 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-vim-commonamazon-linux-2023-upgrade-vim-dataamazon-linux-2023-upgrade-vim-debuginfoamazon-linux-2023-upgrade-vim-debugsourceamazon-linux-2023-upgrade-vim-default-editoramazon-linux-2023-upgrade-vim-enhancedamazon-linux-2023-upgrade-vim-enhanced-debuginfoamazon-linux-2023-upgrade-vim-filesystemamazon-linux-2023-upgrade-vim-minimalamazon-linux-2023-upgrade-vim-minimal-debuginfoamazon-linux-2023-upgrade-xxdamazon-linux-2023-upgrade-xxd-debuginfo | Feb 17, 2025 | Oct 27, 2023 | |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Oct 27, 2023 | |
| Dell Powerstore Dsa2024120 | dell-powerstoreos-upgrade-latest | Oct 23, 2025 | Mar 26, 2024 | |
| Dell Powerstore Dsa2024158 | dell-powerstoreos-upgrade-latest | Jan 13, 2026 | Apr 4, 2024 | |
| Dell Powerstore Dsa2024432 | dell-powerstoreos-upgrade-latest | Oct 23, 2025 | Oct 29, 2024 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-vim-commonhuawei-euleros-2_0_sp10-upgrade-vim-enhancedhuawei-euleros-2_0_sp10-upgrade-vim-filesystemhuawei-euleros-2_0_sp10-upgrade-vim-minimal | Jan 10, 2024 | Oct 27, 2023 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-vim-commonhuawei-euleros-2_0_sp11-upgrade-vim-enhancedhuawei-euleros-2_0_sp11-upgrade-vim-filesystemhuawei-euleros-2_0_sp11-upgrade-vim-minimal | Jan 29, 2024 | Oct 27, 2023 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-vim-commonhuawei-euleros-2_0_sp8-upgrade-vim-enhancedhuawei-euleros-2_0_sp8-upgrade-vim-filesystemhuawei-euleros-2_0_sp8-upgrade-vim-minimalhuawei-euleros-2_0_sp8-upgrade-vim-x11 | Mar 13, 2024 | Oct 27, 2023 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-vim-commonhuawei-euleros-2_0_sp9-upgrade-vim-enhancedhuawei-euleros-2_0_sp9-upgrade-vim-filesystemhuawei-euleros-2_0_sp9-upgrade-vim-minimal | Feb 12, 2024 | Oct 27, 2023 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Oct 27, 2023 | |
| Suse | — | suse-upgrade-gvimsuse-upgrade-vimsuse-upgrade-vim-datasuse-upgrade-vim-data-commonsuse-upgrade-vim-small | Nov 27, 2023 | Oct 27, 2023 |
| Ubuntu | ubuntu-pro-upgrade-vimubuntu-pro-upgrade-vim-athenaubuntu-pro-upgrade-vim-gtkubuntu-pro-upgrade-vim-gtk3ubuntu-pro-upgrade-vim-noxubuntu-pro-upgrade-vim-tinyubuntu-pro-upgrade-xxdubuntu-upgrade-vimubuntu-upgrade-vim-athenaubuntu-upgrade-vim-gtkubuntu-upgrade-vim-gtk3ubuntu-upgrade-vim-noxubuntu-upgrade-vim-tinyubuntu-upgrade-xxd | Dec 19, 2023 | Oct 27, 2023 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Oct 27, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub