Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite

CVE	CVE-2023-48706
State	PUBLISHED
Assigner	GitHub_M
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-11-22 22:15:08 UTC
Updated	2026-06-23 18:17:35 UTC
Description	Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.

Primary CVSS: v3.1 4.7 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS: 0.004410000 probability, percentile 0.352910000 (date 2026-06-28)

Problem Types: CWE-416 | CWE-416 CWE-416: Use After Free

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	4.7	MEDIUM	`CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H`
3.1	[email protected]	Secondary	3.6	LOW	`CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L`
3.1	CNA	DECLARED	3.6	LOW	`CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L`

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Application	Vim	Vim	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Vim	Vim	affected < 9.0.2121	Not specified

Reference	Source	Link	Tags
lists.fedoraproject.org/archives/list/[email protected]/messag...	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org
www.openwall.com/lists/oss-security/2023/11/22/3	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com	Mailing List, Patch, Third Party Advisory
lists.fedoraproject.org/archives/list/[email protected]/messag...	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org
github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb	af854a3a-2127-422b-91ae-364da2661108	github.com	Patch
github.com/gandalf4a/crash_report/blob/main/vim/vim_huaf	af854a3a-2127-422b-91ae-364da2661108	github.com	Exploit
github.com/vim/vim/pull/13552	af854a3a-2127-422b-91ae-364da2661108	github.com	Issue Tracking, Patch
security.netapp.com/advisory/ntap-20240105-0001	af854a3a-2127-422b-91ae-364da2661108	security.netapp.com
github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53q	af854a3a-2127-422b-91ae-364da2661108	github.com	Exploit, Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

200016 Ubuntu Security Notification for Vim Vulnerabilities (USN-6557-1)
284816 Fedora Security Update for vim (FEDORA-2023-ca6c3651fe)
285093 Fedora Security Update for vim (FEDORA-2023-3fbd936b15)
296107 Oracle Solaris 11.4 Support Repository Update (SRU) 65.157.1 Missing (CPUJAN2024)
505962 Alpine Linux Security Update for vim
673345 EulerOS Security Update for vim (EulerOS-SA-2024-1130)
673930 EulerOS Security Update for vim (EulerOS-SA-2024-1189)
673976 EulerOS Security Update for vim (EulerOS-SA-2024-1209)
674019 EulerOS Security Update for vim (EulerOS-SA-2024-1329)
674064 EulerOS Security Update for vim (EulerOS-SA-2024-1114)
674111 EulerOS Security Update for vim (EulerOS-SA-2024-1351)
755920 SUSE Enterprise Linux Security Update for vim (SUSE-SU-2024:0783-1)
755972 SUSE Enterprise Linux Security Update for vim (SUSE-SU-2024:0871-1)
907738 Common Base Linux Mariner (CBL-Mariner) Security Update for vim (32047-1)