CVE-2024-41965
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vim before v9.1.0648 has a double-free vulnerability in dialog_changed(). When abandoning a buffer, Vim may ask the user what to do. If the buffer had no name and the user chooses to save, Vim creates a new Untitled file, but setting the buffer name leads to a double-free, possibly causing heap-use-after-free and crash.
Risk Assessment
Potential for Vim crashes and possibly arbitrary code execution.
Recommendation
Update Vim to version 9.1.0648 or later.
Other vulnerabilities in Vim
See all- CVE-2017-11109High
Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file.
- CVE-2016-1248High
Vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax', and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
- CVE-2024-43802Medium
Vim is an improved version of the Unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. This may lead to the tb_off position within the buffer being out of bounds.
- CVE-2024-47814Low
In Vim before 9.1.0764, a use-after-free occurs when closing a buffer and a BufWinLeave auto command reopens the same buffer in a new split window.
- CVE-2026-34714Critical
A vulnerability in Vim before version 9.2.0272 allows immediate code execution upon opening a crafted file in the default configuration. The issue is due to %{expr} injection in tabpanel lacking the P_MLE flag.
- CVE-2017-6350Critical
An integer overflow at an unserialize_uep memory allocation site occurs for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
- CVE-2017-6349Critical
An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
- CVE-2017-5953Critical
Vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
- CVE-2026-43961High
Vim's netrw plugin contains a vulnerability that allows arbitrary Vimscript execution via a crafted filename with quote characters and expression fragments. This can lead to shell command execution with the privileges of the user running Vim.
- CVE-2026-73073High
Vim prior to 9.2.0845 has a vulnerability in StructMembers() in runtime/autoload/ccomplete.vim, which constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.
Original NVD description (English source)
Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS