Neovim vulnerabilities
30 vulnerabilities
Known vulnerabilities in Neovim, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-4019alpinevim+8
EPSS score1.93%
vim is vulnerable to Heap-based Buffer OverflowCVE-2025-22134alpinevim+6EPSS score0.37%
When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003CVE-2022-4141alpinevim+8EPSS score0.45%
Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.CVE-2022-3296debianvim+5EPSS score0.56%
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.CVE-2022-3037alpinevim+6EPSS score0.53%
Use After Free in GitHub repository vim/vim prior to 9.0.0322.CVE-2022-3256alpinevim+7EPSS score0.49%
Use After Free in GitHub repository vim/vim prior to 9.0.0530.CVE-2022-3591debianvim+4EPSS score0.39%
Use After Free in GitHub repository vim/vim prior to 9.0.0789.CVE-2022-3297debianvim+5EPSS score0.52%
Use After Free in GitHub repository vim/vim prior to 9.0.0579.CVE-2022-3134alpinevim+6EPSS score0.56%
Use After Free in GitHub repository vim/vim prior to 9.0.0389.CVE-2022-3324debianvim+6EPSS score0.53%
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.CVE-2024-41965alpinevim+4EPSS score0.33%
Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.CVE-2024-43374alpinevim+7EPSS score0.35%
The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.CVE-2019-12735alpinevim+46EPSS score18.96%
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.CVE-2026-25749alpinevim+8EPSS score0.22%
Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.CVE-2026-45130alpinevim+4EPSS score0.20%
Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.CVE-2023-2426applemacos+8EPSS score0.41%
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.CVE-2023-1170alpinevim+6EPSS score0.50%
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.CVE-2023-1175alpinevim+9EPSS score0.45%
Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.CVE-2023-48706alpinevim+6EPSS score0.54%
Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.CVE-2023-0433alpinevim+7EPSS score0.52%
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.