CVE-2023-4752: neovim neovim – CVSS 7.8 · Watchpost

← All vulnerabilities

CVE-2023-4752

HIGH 7.8CVE-2023-4752 · Published 04/09/2023 · updated 17/09/2026

In short

CVE-2023-4752 is a HIGH (CVSS 7.8) vulnerability affecting neovim (neovim), vim (vim).
Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.9% of all vulnerabilities.
Fix: update to 0.10.0, 9.0.1858 or later.

Package	Affected versions	Patched versions
neovim neovim	`≥ 0.5.0, < 0.10.0`	`0.10.0`
vim vim	`< 9.0.1858`	`9.0.1858`

Description

Use After Free in GitHub repository vim/vim prior to 9.0.1858.

References

seclists.org/fulldisclosure/2023/Oct/24 · Mailing List
vim/vim commit ee9166e · Patch
huntr.dev/bounties/85f62dd7-ed84-4fa2-b265-8a369a318757 · Exploit
lists.debian.org/debian-lts-announce/2023/09/msg00035.html · Mailing List
lists.fedoraproject.org/archives/list/[email protected]/message/I56ITJAFMFAQ2G3BMGTCGM3GS62V2DTR · Mailing List
lists.fedoraproject.org/archives/list/[email protected]/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF · Mailing List
lists.fedoraproject.org/archives/list/[email protected]/message/PFE3LDFRZ7EGWA5AU7YHYL62ELBOFZWQ · Mailing List
support.apple.com/kb/HT213984 · Release Notes
lists.debian.org/debian-lts-announce/2025/03/msg00023.html

More vulnerabilities in neovim

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free