CVE-2019-20079

The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.

7.8 HighFix available

The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.89%Up 0.9 points since Apr 14, 2021

What each source reports

NVD Score used 7.8

The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.

Record: CVE-2019-20079
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.

Record: CVE-2019-20079
Updated: 2026-11-02

EUVDEUVD-2019-10635 No score

The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.

Record: EUVD-2019-10635
Updated: 2026-11-03

GitHub AdvisoriesGHSA-m46q-8w93-c76v 7.8

The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.

The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.

Record: GHSA-m46q-8w93-c76v
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSV 7.8

The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.

Record: CVE-2019-20079
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-20079 7.8

The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.

Record: DEBIAN-CVE-2019-20079
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-20079 7.8

The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.

Record: UBUNTU-CVE-2019-20079
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2020-0151 No score

Updated vim packages fix security vulnerability

It was discovered that the autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory (CVE-2019-20079).

Record: MGASA-2020-0151
Updated: 2026-11-02

OSVUSN-4309-1 No score

vim vulnerabilities

It was discovered that Vim incorrectly handled certain sources. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS (CVE-2017-11109)

It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. (CVE-2017-5953)

It was discovered that Vim incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.06 LTS. (CVE-2018-20786)

It was discovered that Vim incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-20079)

It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. (CVE-2017-6349, CVE-2017-6350)

Record: USN-4309-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`vim` Debian:12	before 2:8.1.2136-1	2:8.1.2136-1
`vim` Debian:13	before 2:8.1.2136-1	2:8.1.2136-1
`vim` Debian:14	before 2:8.1.2136-1	2:8.1.2136-1
`vim` Mageia:7	before 8.1.2136-1.mga7	8.1.2136-1.mga7
`vim` Ubuntu:18.04:LTS	before 2:8.0.1453-1ubuntu1.3, plus listed versions 2:8.0.0197-4ubuntu52:8.0.1144-1ubuntu12:8.0.1401-1ubuntu12:8.0.1401-1ubuntu22:8.0.1401-1ubuntu32:8.0.1453-1ubuntu12:8.0.1453-1ubuntu1.1	2:8.0.1453-1ubuntu1.3
`vim` Ubuntu:Pro:14.04:LTS From an advisory covering 6 CVEs	before 2:7.4.052-1ubuntu3.1+esm1, plus listed versions 2:7.4.000-1ubuntu22:7.4.052-1ubuntu12:7.4.052-1ubuntu22:7.4.052-1ubuntu32:7.4.052-1ubuntu3.1	2:7.4.052-1ubuntu3.1+esm1
`vim` Ubuntu:16.04:LTS From an advisory covering 6 CVEs	before 2:7.4.1689-3ubuntu1.4, plus listed versions 2:7.4.712-2ubuntu42:7.4.826-1ubuntu12:7.4.826-1ubuntu22:7.4.826-1ubuntu32:7.4.963-1ubuntu1 Show 6 moreShow less 2:7.4.963-1ubuntu42:7.4.963-1ubuntu52:7.4.1689-3ubuntu12:7.4.1689-3ubuntu1.12:7.4.1689-3ubuntu1.22:7.4.1689-3ubuntu1.3	2:7.4.1689-3ubuntu1.4
`vim` Ubuntu:18.04:LTS From an advisory covering 6 CVEs	before 2:8.0.1453-1ubuntu1.3, plus listed versions 2:8.0.0197-4ubuntu52:8.0.1144-1ubuntu12:8.0.1401-1ubuntu12:8.0.1401-1ubuntu22:8.0.1401-1ubuntu32:8.0.1453-1ubuntu12:8.0.1453-1ubuntu1.1	2:8.0.1453-1ubuntu1.3

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-20079 is a high vulnerability (CVSS 7.8) in Vim, published December 30, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.89%, the 79th percentile. Fixed in vim 2:8.1.2136-1.

References

Show 11 moreShow less