Updated: 2025-08-20 02:31:57.290293
Description:
Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.
| Links | NIST | CIRCL | RHEL | Ubuntu |
| Severity | Score | |
|---|---|---|
| CVSS Version 2.x | 0.0 | |
| CVSS Version 3.x | MEDIUM | 5.5 |
| OS name | Project name | Version | Score | Severity | Status | Errata | Last updated | Statement |
|---|---|---|---|---|---|---|---|---|
| AlmaLinux 9.2 ESU | vim | 8.2.2637 | 5.5 | MEDIUM | Ignored | 2025-01-10 00:56:11 | This flaw is local-only and exploitable only within a running Vim session via a crafted use of the :... | |
| CentOS 6 ELS | vim | 7.4.629 | 5.5 | MEDIUM | Ignored | 2023-11-10 02:29:05 | Ignored due to low severity | |
| CentOS 7 ELS | vim | 7.4.629 | 5.5 | MEDIUM | Ignored | 2024-06-25 11:20:07 | Ignored due to low severity | |
| CloudLinux 6 ELS | vim | 7.4.629 | 5.5 | MEDIUM | Ignored | 2023-11-10 02:29:05 | Ignored due to low severity | |
| Debian 10 ELS | vim | 8.1.0875 | 5.5 | MEDIUM | Ignored | 2025-10-11 00:16:57 | Ignored due to low severity | |
| Oracle Linux 6 ELS | vim | 7.4.629 | 5.5 | MEDIUM | Ignored | 2023-11-10 02:29:05 | Ignored due to low severity | |
| Ubuntu 16.04 ELS | vim | 7.4.1689-3 | 5.5 | MEDIUM | Released | CLSA-2024:1705077885 | 2024-01-12 13:10:49 |