Read the docs
TI-2023-26545 Aliases CVE-2023-48706

Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite

Priority MEDIUM 55CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00544 45th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial vim (vim): 9.0.2121Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vimvimbefore 9.0.21219.0.2121Patch availableCNA
  • vim Vendorvim Affected before 9.0.2121 Fixed in 9.0.2121 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:neovim:neovim:*:*:*:*:*:*:*:*up to 0.9.5VulnerableNeovim
cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*before 9.0.2121Vulnerablevim
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
  • cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:neovim:neovim:*:*:*:*:*:*:*:* Versions up to 0.9.5 Vulnerable ·Neovim
  • cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* Versions before 9.0.2121 Vulnerable ·vim

Remediation

  • Fix · CNA vim (vim) Fixed in 9.0.2121

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)Affected—

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-48706
  2. 2026-11-07 Affected versions changed · Red Hat

References

Exploit 2

Patch 3

Advisory 3

  • TI-2022-03248 Heap-based Buffer Overflow in vim/vim CVSS 3.1CRITICAL 9.8
  • TI-2024-15103 Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c… CVSS 3.1HIGH 7.8
  • TI-2023-05093 Use After Free in vim/vim CVSS 3.1HIGH 7.8
  • TI-2023-04407 Heap-based Buffer Overflow in vim/vim CVSS 3.1HIGH 7.8
  • TI-2023-04379 Heap-based Buffer Overflow in vim/vim CVSS 3.1HIGH 7.8
  • TI-2023-04378 Use After Free in vim/vim CVSS 3.1HIGH 7.8
See all 258 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences