CVE-2023-0433: neovim neovim – CVSS 7.8 · Watchpost

← All vulnerabilities

CVE-2023-0433

HIGH 7.8CVE-2023-0433 · Published 21/01/2023 · updated 24/09/2026

In short

CVE-2023-0433 is a HIGH (CVSS 7.8) vulnerability affecting neovim (neovim), vim (vim).
Chance of exploitation in the next 30 days (EPSS): 0.53%, higher than 44.9% of all vulnerabilities.
Fix: update to 0.8.3, 9.0.1225 or later.

Package	Affected versions	Patched versions
neovim neovim	`≥ 0.1.0, < 0.8.3`	`0.8.3`
vim vim	`< 9.0.1225`	`9.0.1225`

Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.

References

seclists.org/fulldisclosure/2023/Mar/17 · Mailing List
seclists.org/fulldisclosure/2023/Mar/18 · Mitigation
seclists.org/fulldisclosure/2023/Mar/21 · Mailing List
vim/vim commit 11977f9 · Patch
huntr.dev/bounties/ae933869-a1ec-402a-bbea-d51764c6618e · Exploit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EX6N2DB75A73MQGVW3CS4VTNPAYVM2M · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWIJBSQX53P7DHV77KRXJIXA4GH7XHC · Mailing List
support.apple.com/kb/HT213670 · Third Party Advisory
support.apple.com/kb/HT213675 · Third Party Advisory
support.apple.com/kb/HT213677 · Third Party Advisory

More vulnerabilities in neovim

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free