CVE-2023-1175: neovim neovim – CVSS 6.6 · Watchpost

← All vulnerabilities

CVE-2023-1175

MEDIUM 6.6CVE-2023-1175 · Published 04/03/2023 · updated 18/09/2026

In short

CVE-2023-1175 is a MEDIUM (CVSS 6.6) vulnerability affecting neovim (neovim), vim (vim).
Chance of exploitation in the next 30 days (EPSS): 0.45%, higher than 39.0% of all vulnerabilities.
Fix: update to 9.0.1378 or later.

Package	Affected versions	Patched versions
neovim neovim	`≤ 0.8.3`	No fix yet
vim vim	`< 9.0.1378`	`9.0.1378`

Description

Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.

References

vim/vim commit c99cbf8 · Patch
huntr.dev/bounties/7e93fc17-92eb-4ae7-b01a-93bb460b643e · Exploit
lists.debian.org/debian-lts-announce/2023/06/msg00015.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIAKPMKJ4OZ6NYRZJO7YWMNQL2BICLYV · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE44W6WMMREYCW3GJHPSYP7NK2VT5NY6 · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4KDAU76Z7QNSPKZX2JAJ6O7KIEOXWTL · Mailing List
lists.debian.org/debian-lts-announce/2025/03/msg00023.html · Mailing List

More vulnerabilities in neovim

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free