| CVE-2026-45130 | MÉDIO5.5 | Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer | 08/05/2026 |
| CVE-2026-25749 | MÉDIO6.6 | Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user- | 06/02/2026 |
| CVE-2025-22134 | MÉDIO5.5 | When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening | 13/01/2025 |
| CVE-2024-43374 | MÉDIO4.7 | The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structu | 16/08/2024 |
| CVE-2024-41965 | MÉDIO4.2 | Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, wh | 01/08/2024 |
| CVE-2023-48706 | MÉDIO4.7 | Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed b | 22/11/2023 |
| CVE-2023-5535 | ALTO7.8 | Use After Free in GitHub repository vim/vim prior to v9.0.2010. | 11/10/2023 |
| CVE-2023-4781 | ALTO7.8 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. | 05/09/2023 |
| CVE-2023-4752 | ALTO7.8 | Use After Free in GitHub repository vim/vim prior to 9.0.1858. | 04/09/2023 |
| CVE-2023-4750 | ALTO7.8 | Use After Free in GitHub repository vim/vim prior to 9.0.1857. | 04/09/2023 |
| CVE-2023-4733 | ALTO7.8 | Use After Free in GitHub repository vim/vim prior to 9.0.1840. | 04/09/2023 |
| CVE-2023-4751 | ALTO7.8 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331. | 03/09/2023 |
| CVE-2023-4738 | ALTO7.8 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848. | 02/09/2023 |
| CVE-2023-4734 | ALTO7.8 | Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. | 02/09/2023 |
| CVE-2023-2426 | MÉDIO5.3 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. | 29/04/2023 |
| CVE-2023-1175 | MÉDIO6.6 | Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. | 04/03/2023 |
| CVE-2023-1170 | MÉDIO6.6 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. | 03/03/2023 |
| CVE-2023-0433 | ALTO7.8 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. | 21/01/2023 |
| CVE-2023-0288 | ALTO7.8 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. | 13/01/2023 |
| CVE-2023-0049 | ALTO7.8 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. | 04/01/2023 |