Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 262

Export CSV
CVE-2025-24014

segmentation fault in win_line() in Vim < 9.1.1043

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp Vim
Products
Hci Compute Node Hci Compute Node Firmware Vim
CVE-2025-1215

vim main.c memory corruption

A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Netapp Vim
Products
Bootstrap Os Vim
CVE-2025-55157

Vim heap use-after-free vulnerability when processing recursive tuple data types

Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1400, When processing nested tuples in Vim script, an error during evaluation can trigger a use-after-free in Vim’s internal tuple reference management. Specifically, the tuple_unref() function may access already freed memory due to improper lifetime handling, leading to memory corruption. The exploit requires direct user interaction, as the script must be explicitly executed within Vim. This issue has been patched in version 9.1.1400.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2025-55158

Vim double-free vulnerability during Vim9 script import operations

Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1406, when processing nested tuples during Vim9 script import operations, an error during evaluation can trigger a double-free in Vim’s internal typed value (typval_T) management. Specifically, the clear_tv() function may attempt to free memory that has already been deallocated, due to improper lifetime handling in the handle_import / ex_import code paths. The vulnerability can only be triggered if a user explicitly opens and executes a specially crafted Vim script. This issue has been patched in version 9.1.1406.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2022-3278

NULL Pointer Dereference in vim/vim

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim
CVE-2022-3520

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2017-6350

vim: Integer overflow at an unserialize_uep memory allocation site

An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2017-17087

vim: Sets the group ownership of a .swp file to the editor's primary group

fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Vim
Products
Ubuntu Linux Debian Linux Vim
CVE-2017-5953

vim: Tree length values not validated properly when handling a spell file

vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2017-6349

vim: Integer overflow at a u_read_undo memory allocation site

An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

CVSS 3.0 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2017-1000382

vim: Ignores umask when creating a swap file

VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2017-11109

vim: Use-after-free via crafted file

Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. NOTE: there might be a limited number of scenarios in which this has security relevance.

CVSS 3.0 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2022-3705

vim autocmd quickfix.c qf_update_buffer use after free

A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324.

CVSS 3.1 · 5 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 1 more
Products
Debian Linux Fedora Active Iq Unified Manager and 1 more
CVE-2022-4293

Floating Point Comparison with Incorrect Operator in vim/vim

Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2016-1248

vim: Lack of validation of values for few options results in code exection

vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.

CVSS 3.0 · 7.8 High EPSS 25.3% KEV · Not listed
Vendors
Debian Redhat Vim
Products
Debian Linux Enterprise Linux Vim
CVE-2023-0051

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2022-47024

vim: no check if the return value of XChangeGC() is NULL

A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Vim
Products
Enterprise Linux Vim
CVE-2023-0512

Divide By Zero in vim/vim

Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim