Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

vim may allow attackers to run code

CVE-2021-3974 · published 4 years ago
Summary

The vim text editor on several Linux distributions can be tricked into executing unwanted code. This happens because the program mishandles memory, which could let a malicious file or input take control of the system. Update vim to the latest version provided by your Linux vendor to protect against this risk.

What to do
  • Update vim vim to version 8.2.3612 or later.
  • Update vim vim/vim to version 8.2.3612 or later.
Affected software
VendorProductAffected versions
vim vim < 8.2.3612
cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*
fedoraproject fedora 34
35
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
debian debian_linux 9.0
10.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
vim vim/vim < 8.2.3612
Original advisory text
Use After Free in vim/vim
vim is vulnerable to Use After Free
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published19 Nov 2021
Updated4 Nov 2026
First seen11 Apr 2026
Sources
CVE-2021-3974 · OSV
CVE-2021-3974 · NVD
CVE-2021-3974 · MITRE
Track software like this
Free during beta