Use After Free in GitHub repository vim/vim prior to 9.0.0490.

Use After Free in GitHub repository vim/vim prior to 9.0.0579.

Use After Free in GitHub repository vim/vim prior to 9.0.0530.

Use After Free in GitHub repository vim/vim prior to 9.0.0360.

Use After Free in GitHub repository vim/vim prior to 9.0.0389.

Use After Free in GitHub repository vim/vim prior to 9.0.0246.

Use After Free in GitHub repository vim/vim prior to 9.0.0322.

Use After Free in GitHub repository vim/vim prior to 9.0.0260.

Use After Free in GitHub repository vim/vim prior to 9.0.0286.

Use After Free in GitHub repository vim/vim prior to 9.0.0221.

Use After Free in GitHub repository vim/vim prior to 9.0.0225.

Use After Free in GitHub repository vim/vim prior to 9.0.0213.

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.

Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

Use After Free in GitHub repository vim/vim prior to 9.0.

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.

Use After Free in GitHub repository vim/vim prior to 8.2.4979.

Use After Free in GitHub repository vim/vim prior to 8.2.

Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969.

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Use After Free in GitHub repository vim/vim prior to 8.2.

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.

vim is vulnerable to Use After Free

vim is vulnerable to Use After Free

vim is vulnerable to Use After Free

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.

Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags, but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647

Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute malicious executables placed in the current working directory for the current edited file. On Windows, when using cmd.exe as a shell, Vim resolves external commands by searching the current working directory before system paths. When Vim invokes tools such as findstr for :grep, external commands or filters via :!, or compiler/:make commands, it may inadvertently run a malicious executable present in the same directory as the file being edited. The issue affects Vim for Windows prior to version 9.1.1947.

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

Use After Free in GitHub repository vim/vim prior to v9.0.2010.

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.

Use After Free in GitHub repository vim/vim prior to 9.0.1858.

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.