CVE-2023-48231 Use-After-Free in win_close() in vim

2023-11-1622:59:37

CWE-416

GitHub_M

www.cve.org

cve-2023-48231

open source

text editor

exploitation

window structure

commit 25aabc2b

release version 9.0.2106

upgrade

vulnerability

3.9 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.2%

JSON

Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit 25aabc2b which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CNA Affected

[
  {
    "vendor": "vim",
    "product": "vim",
    "versions": [
      {
        "version": "< 9.0.2106",
        "status": "affected"
      }
    ]
  }
]