Updated: 2025-08-20 00:01:28.167108
Description:
Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `ac6378773` which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability.
| Links | NIST | CIRCL | RHEL | Ubuntu |
| Severity | Score | |
|---|---|---|
| CVSS Version 2.x | 0.0 | |
| CVSS Version 3.x | MEDIUM | 4.3 |
| OS name | Project name | Version | Score | Severity | Status | Errata | Last updated | Statement |
|---|---|---|---|---|---|---|---|---|
| AlmaLinux 9.2 ESU | vim | 8.2.2637 | 4.3 | MEDIUM | Ignored | 2025-01-10 00:56:09 | This flaw is a local, user-initiated denial‑of‑service in Vim’s :s command: supplying an exces... | |
| CentOS 6 ELS | vim | 7.4.629 | 4.3 | MEDIUM | Ignored | 2023-12-01 03:18:49 | Ignored due to low severity | |
| CentOS 7 ELS | vim | 7.4.629 | 4.3 | MEDIUM | Ignored | 2024-06-25 11:20:07 | Ignored due to low severity | |
| CloudLinux 6 ELS | vim | 7.4.629 | 4.3 | MEDIUM | Ignored | 2023-12-01 03:18:49 | Ignored due to low severity | |
| Debian 10 ELS | vim | 8.1.0875 | 4.3 | MEDIUM | Ignored | 2025-10-11 00:16:56 | Ignored due to low severity | |
| Oracle Linux 6 ELS | vim | 7.4.629 | 4.3 | MEDIUM | Ignored | 2023-12-01 03:18:49 | Ignored due to low severity | |
| Ubuntu 16.04 ELS | vim | 7.4.1689-3 | 4.3 | MEDIUM | Released | CLSA-2024:1705077885 | 2024-01-12 13:09:48 |