What’s Vulnerable › Vulnerabilities
CVE-2023-4733: Use After Free in vim/vim
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-09-04 · updated 2026-09-18
- Weakness: CWE-416
Description
Use After Free in GitHub repository vim/vim prior to 9.0.1840.
Affected products
- Apple macOS: before 14.1 — fixed in 14.1
- Fedoraproject Fedora: 37, 38, 39
- Neovim: from 0.7.0 before 0.9.2 — fixed in 0.9.2
- vim/vim: before 9.0.1840 — fixed in 9.0.1840
How to fix
Upgrade to a fixed version: Apple macOS 14.1; Neovim 0.9.2; vim/vim 9.0.1840. Check the vendor advisory for mitigations.
References
- http://seclists.org/fulldisclosure/2023/Oct/24
- https://github.com/vim/vim/commit/e1dc9a627536304bc4f738c21e909ad9fcf3974c
- https://huntr.dev/bounties/1ce1fd8c-050a-4373-8004-b35b61590217
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I56ITJAFMFAQ2G3BMGTCGM3GS62V2DTR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFE3LDFRZ7EGWA5AU7YHYL62ELBOFZWQ/
- https://support.apple.com/kb/HT213984
- http://seclists.org/fulldisclosure/2023/Oct/24
- https://github.com/vim/vim/commit/e1dc9a627536304bc4f738c21e909ad9fcf3974c
- https://huntr.dev/bounties/1ce1fd8c-050a-4373-8004-b35b61590217
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I56ITJAFMFAQ2G3BMGTCGM3GS62V2DTR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF/
Get alerted when CVE-2023-4733 or the next vulnerability affects your stack