TI-2023-26096 Aliases CVE-2023-48232

Floating point Exception in adjust_plines_for_skipcol() in vim

LOW 21CWE-755Published 2023-11-16 · Updated 2026-06-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled and the cpo-settings include the 'n' flag. This may happen when a window border is present and when the wrapped line continues on the next physical line directly in the window border because the 'cpo' setting includes the 'n' flag. Only users with non-default settings are affected and the exception should only result in a crash. This issue has been addressed in commit `cb0b99f0` which has been included in release version 9.0.2107. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00674 52nd percentileScored 2026-11-07

Fix Partial vim (vim): 9.0.2107Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
vim	vim	before 9.0.2107	9.0.2107	Patch available	CNA

vim Vendorvim Affected before 9.0.2107 Fixed in 9.0.2107 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:vim:vim::::::::	before 9.0.2107	Vulnerable	vim
cpe:2.3:o:fedoraproject:fedora:37:::::::*	37	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:38:::::::*	38	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:39:::::::*	39	Vulnerable	Fedoraproject

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* Versions before 9.0.2107 Vulnerable ·vim
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject

Remediation

Fix · CNA vim (vim) Fixed in 9.0.2107

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	—

Timeline

2026-10-02 Threatist record created from CVE-2023-48232
2026-11-07 Affected versions changed · Red Hat

References

Patch 1

https://github.com/vim/vim/commit/cb0b99f0672d8446585d26e998343dceca17d1ce

Advisory 5

Other 1

http://www.openwall.com/lists/oss-security/2023/11/16/1

TI-2022-03248 Heap-based Buffer Overflow in vim/vim CVSS 3.1CRITICAL 9.8
TI-2024-15103 Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c… CVSS 3.1HIGH 7.8
TI-2023-05093 Use After Free in vim/vim CVSS 3.1HIGH 7.8
TI-2023-04407 Heap-based Buffer Overflow in vim/vim CVSS 3.1HIGH 7.8
TI-2023-04379 Heap-based Buffer Overflow in vim/vim CVSS 3.1HIGH 7.8
TI-2023-04378 Use After Free in vim/vim CVSS 3.1HIGH 7.8

See all 258 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences