Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 264

Export CSV
CVE-2024-47814

use-after-free when closing buffers in Vim

Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Netapp Vim
Products
Bootstrap Os Hci Compute Node Vim
CVE-2023-5344

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim
CVE-2023-0054

Out-of-bounds Write in vim/vim

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2025-9390

vim xxd xxd.c main buffer overflow

A security flaw has been discovered in vim up to 9.1.1615. Affected by this vulnerability is the function main of the file src/xxd/xxd.c of the component xxd. The manipulation results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be exploited. Upgrading to version 9.1.1616 addresses this issue. The patch is identified as eeef7c77436a78cd27047b0f5fa6925d56de3cb0. It is recommended to upgrade the affected component.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2025-9389

vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption

A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, "when coloring is turned on".

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Vim
Products
Vim
CVE-2025-26603

heap-use-after-free in function str_to_reg in vim/vim

Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp Vim
Products
Hci Compute Node Vim
CVE-2025-27423

Improper Input Validation in Vim

Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164

CVSS 3.1 · 7.1 High EPSS 22.5% KEV · Not listed
Vendors
Netapp Vim
Products
Hci Compute Node Vim
CVE-2024-43790

heap-buffer-overflow in do_search() in Vim < 9.1.0689

Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern is displayed at the bottom of the screen in a buffer (msgbuf). When right-left mode (:set rl) is enabled, the search pattern is reversed. This happens by allocating a new buffer. If the search pattern contains some ASCII NUL characters, the buffer allocated will be smaller than the original allocated buffer (because for allocating the reversed buffer, the strlen() function is called, which only counts until it notices an ASCII NUL byte ) and thus the original length indicator is wrong. This causes an overflow when accessing characters inside the msgbuf by the previously (now wrong) length of the msgbuf. The issue has been fixed as of Vim patch v9.1.0689.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp Vim
Products
Bootstrap Os Hci Compute Node Vim
CVE-2025-29768

Vim vulnerable to potential data loss with zip.vim and special crafted zip files

Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch v9.1.1198.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp Vim
Products
Bootstrap Os Hci Compute Node Vim