What’s Vulnerable › Vulnerabilities
CVE-2023-4752: Use After Free in vim/vim
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-09-04 · updated 2026-09-17
- Weakness: CWE-416
Description
Use After Free in GitHub repository vim/vim prior to 9.0.1858.
Affected products
- Apple macOS: before 14.1 — fixed in 14.1
- Debian Linux: 10.0, 11.0
- Fedoraproject Fedora: 37, 38, 39
- Neovim: from 0.5.0 before 0.10.0 — fixed in 0.10.0
- vim/vim: before 9.0.1858 — fixed in 9.0.1858
How to fix
Upgrade to a fixed version: Apple macOS 14.1; Neovim 0.10.0; vim/vim 9.0.1858. Check the vendor advisory for mitigations.
References
- http://seclists.org/fulldisclosure/2023/Oct/24
- https://github.com/vim/vim/commit/ee9166eb3b41846661a39b662dc7ebe8b5e15139
- https://huntr.dev/bounties/85f62dd7-ed84-4fa2-b265-8a369a318757
- https://lists.debian.org/debian-lts-announce/2023/09/msg00035.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I56ITJAFMFAQ2G3BMGTCGM3GS62V2DTR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFE3LDFRZ7EGWA5AU7YHYL62ELBOFZWQ/
- https://support.apple.com/kb/HT213984
- http://seclists.org/fulldisclosure/2023/Oct/24
- https://github.com/vim/vim/commit/ee9166eb3b41846661a39b662dc7ebe8b5e15139
- https://huntr.dev/bounties/85f62dd7-ed84-4fa2-b265-8a369a318757
- https://lists.debian.org/debian-lts-announce/2023/09/msg00035.html
Get alerted when CVE-2023-4752 or the next vulnerability affects your stack