CVE-2023-2426
CVE-2023-2426 is a medium-severity vulnerability in Vim with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-823.
Key facts
- Severity: Medium (CVSS 3.x base score 5.5)
- EPSS exploit prediction: 0% (33rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-823
- Affected product: Vim
- Published:
- Last modified:
Description
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.
Frequently asked questions
- What is CVE-2023-2426?
- Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.
- How severe is CVE-2023-2426?
- CVE-2023-2426 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2023-2426 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-2426?
- CVE-2023-2426 affects Vim. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-2426?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2023-2426 published?
- CVE-2023-2426 was published on 2023-04-29 and last updated on 2026-06-17.
References
- https://github.com/vim/vim/commit/caf642c25de526229264cab9425e7c9979f3509b
- https://huntr.dev/bounties/3451be4c-91c8-4d08-926b-cbff7396f425
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LOJP6M7ZTKZQYOGVOOAY6TIE6ACBJL55/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
Affected products (1)
- cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*
More vulnerabilities in Vim
- CVE-2020-20703 — Critical (CVSS 9.8): Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand…
- CVE-2022-3520 — Critical (CVSS 9.8): Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.
- CVE-2022-0318 — Critical (CVSS 9.8): Heap-based Buffer Overflow in vim/vim prior to 8.2.
- CVE-2017-6350 — Critical (CVSS 9.8): An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does…
- CVE-2017-6349 — Critical (CVSS 9.8): An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not…
- CVE-2017-5953 — Critical (CVSS 9.8): vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may…
Other CWE-823 vulnerabilities
- CVE-2023-43553 — Critical (CVSS 9.8): Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
- CVE-2026-46244 — Critical (CVSS 9.1): In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff…
- CVE-2025-27059 — High (CVSS 8.8): Memory corruption while performing SCM call.
- CVE-2022-0729 — High (CVSS 8.8): Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
- CVE-2017-20211 — High (CVSS 8.6): UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the…
- CVE-2023-20187 — High (CVSS 8.6): A vulnerability in the Multicast Leaf Recycle Elimination (mLRE) feature of Cisco IOS XE Software for Cisco ASR 1000…