{"id":"CVE-2024-41965","aliases":["ALPINE-CVE-2024-41965","AZL-47355","AZL-47391","BELL-CVE-2024-41965","DEBIAN-CVE-2024-41965","EUVD-2024-39296","GHSA-46pw-v7qw-xc2f","OESA-2024-1982","SUSE-SU-2025:02226-1","SUSE-SU-2025:02227-1","SUSE-SU-2025:02228-1"],"status":"published","title":"Vim \u003c v9.1.0648 has a double-free in dialog_changed()","description":"Vim is an open source command line text editor. double-free in dialog_changed() in Vim \u003c v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0033,"percentile":0.26434,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415","CWE-416"],"published":"2024-08-01T21:44:09Z","modified":"2026-11-03T06:32:49Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"vim","fixed_in":["9.1.0652-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"vim","fixed_in":["9.1.0652-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"vim","fixed_in":["9.1.0652-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"vim","fixed_in":["9.1.0652-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vim","fixed_in":["9.1.0652-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"vim","fixed_in":["9.0.2121-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"vim","fixed_in":["9.0.2190-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"vim","fixed_in":["9.1.0936-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"vim","fixed_in":["9.1.0652-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vim","fixed_in":["2:9.1.0698-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vim","fixed_in":["2:9.1.0698-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0652-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0652-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0652-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0652-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0652-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2121-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2190-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0820-r2"},{"fixed":"9.1.0936-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0414-r0"},{"fixed":"9.1.0652-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:9.0.1378-2","2:9.0.1378-2+deb12u1","2:9.0.1378-2+deb12u2","2:9.0.1658-1","2:9.0.1672-1","2:9.0.1894-1","2:9.0.2018-1","2:9.0.2087-1","2:9.0.2103-1","2:9.0.2116-1","2:9.0.2189-1","2:9.1.0-1","2:9.1.0016-1","2:9.1.0199-1","2:9.1.0374-1","2:9.1.0377-1","2:9.1.0496-1","2:9.1.0698-1","2:9.1.0709-1","2:9.1.0709-2","2:9.1.0777-1","2:9.1.0861-1","2:9.1.0967-1","2:9.1.0967-2","2:9.1.1113-1","2:9.1.1230-1","2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1","2:9.2.0338-1","2:9.2.0355-1","2:9.2.0428-1","2:9.2.0461-1","2:9.2.0524-1","2:9.2.0782-1","2:9.2.0858-1"]},{"source":"osv","ecosystem":"Debian:13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0698-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0698-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-24.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-23.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-24.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-8.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-24.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150500.20.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150500.20.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150500.20.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150500.20.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150500.20.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150500.20.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150500.20.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150500.20.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150500.20.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150500.20.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-17.48.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-17.48.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1406-150000.5.75.1"}]}],"bundled":2}],"products":[{"vendor":"neovim","product":"neovim"},{"vendor":"netapp","product":"hci_compute_node"},{"vendor":"vim","product":"vim"}],"references":[{"url":"https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory"]},{"url":"https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20241115-0002/","tags":["Vendor Advisory","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-41965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41965","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-41965","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41965.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-41965","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41957","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502226-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228776","tags":["report"]},{"url":"https://bugzilla.suse.com/1239602","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29768","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502227-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502228-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-41965","title":"Vim \u003c v9.1.0648 has a double-free in dialog_changed()","description":"Vim is an open source command line text editor. double-free in dialog_changed() in Vim \u003c v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.","status":"published","published":"2024-08-01T21:44:09.056Z","modified":"2024-11-15T13:08:18.743Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:34:03.661584Z"}],"euvd":[{"id":"EUVD-2024-39296","description":"Vim is an open source command line text editor. double-free in dialog_changed() in Vim \u003c v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.","status":"published","published":"2024-08-01T21:44:09Z","modified":"2024-11-15T13:08:18Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:59.953537Z"}],"nvd":[{"id":"CVE-2024-41965","description":"Vim is an open source command line text editor. double-free in dialog_changed() in Vim \u003c v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.","status":"published","published":"2024-08-01T22:15:29.567Z","modified":"2026-09-17T17:59:23.527Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-416","CWE-415"],"updated_at":"2026-11-02T14:10:15.933769Z"}],"osv":[{"id":"ALPINE-CVE-2024-41965","description":"Vim is an open source command line text editor. double-free in dialog_changed() in Vim \u003c v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.","status":"published","published":"2024-08-01T22:15:29.567Z","modified":"2026-11-03T06:32:49.852786842Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"AZL-47355","title":"CVE-2024-41965 affecting package vim for versions less than 9.0.2121-4","description":"Vim is an open source command line text editor. double-free in dialog_changed() in Vim \u003c v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.","status":"published","published":"2024-08-01T22:15:29Z","modified":"2026-04-21T04:32:52.752395Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"AZL-47391","title":"CVE-2024-41965 affecting package vim for versions less than 9.0.2190-4","description":"Vim is an open source command line text editor. double-free in dialog_changed() in Vim \u003c v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.","status":"published","published":"2024-08-01T22:15:29Z","modified":"2026-04-21T04:54:17.543803Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"BELL-CVE-2024-41965","status":"published","published":"2024-08-03T05:59:08.4084Z","modified":"2026-01-26T09:35:04.09248Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:20.200735Z"},{"id":"CVE-2024-41965","title":"Vim \u003c v9.1.0648 has a double-free in dialog_changed()","description":"Vim is an open source command line text editor. double-free in dialog_changed() in Vim \u003c v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.","status":"published","published":"2024-08-01T21:44:09.056Z","modified":"2026-10-28T10:58:05.645866078Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:41.963899Z"},{"id":"DEBIAN-CVE-2024-41965","description":"Vim is an open source command line text editor. double-free in dialog_changed() in Vim \u003c v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.","status":"published","published":"2024-08-01T22:15:29.567Z","modified":"2026-11-02T12:02:59.032307677Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"OESA-2024-1982","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026apos;Vi\u0026apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\n\nSecurity Fix(es):\n\nVim is an open source command line text editor. Vim \u0026lt; v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags,\nbut it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647(CVE-2024-41957)\n\nVim is an open source command line text editor. double-free in dialog_changed() in Vim \u0026lt; v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.(CVE-2024-41965)","status":"published","published":"2024-08-16T11:07:27Z","modified":"2026-08-18T01:18:33.019593613Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"SUSE-SU-2025:02226-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2024-41965: Fixed improper neutralization of argument delimiters in zip.vim that could have led to data loss (bsc#1228776).\n- CVE-2025-29768: Fixed double-free in dialog_changed() (bsc#1239602).\n","status":"published","published":"2025-07-04T13:31:08Z","modified":"2026-02-04T03:39:56.963036Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02227-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2024-41965: Fixed improper neutralization of argument delimiters in zip.vim that could have led to data loss (bsc#1228776).\n- CVE-2025-29768: Fixed double-free in dialog_changed() (bsc#1239602).\n","status":"published","published":"2025-07-04T13:31:41Z","modified":"2026-02-04T02:23:58.355628Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02228-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2024-41965: Fixed improper neutralization of argument delimiters in zip.vim that could have led to data loss (bsc#1228776).\n- CVE-2025-29768: Fixed double-free in dialog_changed() (bsc#1239602).\n","status":"published","published":"2025-07-04T13:33:24Z","modified":"2026-02-04T03:13:33.480033Z","updated_at":"2026-11-02T15:53:56.647031Z"}]}}