CVE-2017-11109

Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified...

7.8 HighFix available

Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. NOTE: there might be a limited number of scenarios in which this has security relevance.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.09%Up 0.1 points since Apr 14, 2021

What each source reports

NVD Score used 7.8

Record: CVE-2017-11109
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

Record: CVE-2017-11109
Updated: 2026-11-02

EUVDEUVD-2017-2746 No score

Record: EUVD-2017-2746
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hv76-654r-x97r 7.8

Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified...

Record: GHSA-hv76-654r-x97r
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSV 7.8

Record: CVE-2017-11109
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-11109 7.8

Record: DEBIAN-CVE-2017-11109
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-11109 7.8

Record: UBUNTU-CVE-2017-11109
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-4309-1 No score

vim vulnerabilities

It was discovered that Vim incorrectly handled certain sources. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS (CVE-2017-11109)

It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. (CVE-2017-5953)

It was discovered that Vim incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.06 LTS. (CVE-2018-20786)

It was discovered that Vim incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-20079)

It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. (CVE-2017-6349, CVE-2017-6350)

Record: USN-4309-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`vim` Debian:12	before 2:8.0.0197-5	2:8.0.0197-5
`vim` Debian:13	before 2:8.0.0197-5	2:8.0.0197-5
`vim` Debian:14	before 2:8.0.0197-5	2:8.0.0197-5
`vim` Debian:7	before 2:7.3.547-7+deb7u4, plus listed versions 2:7.3.547-72:7.3.547-7+deb7u12:7.3.547-7+deb7u22:7.3.547-7+deb7u3	2:7.3.547-7+deb7u4
`vim` Debian:8	before 2:7.4.488-7+deb8u4, plus listed versions 2:7.4.488-72:7.4.488-7+deb8u12:7.4.488-7+deb8u22:7.4.488-7+deb8u3	2:7.4.488-7+deb8u4
`vim` Ubuntu:Pro:14.04:LTS	before 2:7.4.052-1ubuntu3.1+esm1, plus listed versions 2:7.4.000-1ubuntu22:7.4.052-1ubuntu12:7.4.052-1ubuntu22:7.4.052-1ubuntu32:7.4.052-1ubuntu3.1	2:7.4.052-1ubuntu3.1+esm1
`vim` Ubuntu:16.04:LTS	before 2:7.4.1689-3ubuntu1.4, plus listed versions 2:7.4.712-2ubuntu42:7.4.826-1ubuntu12:7.4.826-1ubuntu22:7.4.826-1ubuntu32:7.4.963-1ubuntu1 Show 6 moreShow less 2:7.4.963-1ubuntu42:7.4.963-1ubuntu52:7.4.1689-3ubuntu12:7.4.1689-3ubuntu1.12:7.4.1689-3ubuntu1.22:7.4.1689-3ubuntu1.3	2:7.4.1689-3ubuntu1.4
`vim` Ubuntu:18.04:LTS	before 2:8.0.1453-1ubuntu1.3, plus listed versions 2:8.0.0197-4ubuntu52:8.0.1144-1ubuntu12:8.0.1401-1ubuntu12:8.0.1401-1ubuntu22:8.0.1401-1ubuntu32:8.0.1453-1ubuntu12:8.0.1453-1ubuntu1.1	2:8.0.1453-1ubuntu1.3

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-11109 is a high vulnerability (CVSS 7.8) in Vim, published July 8, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in vim 2:8.0.0197-5.

References

Show 9 moreShow less