CVE-2023-4752 Use After Free in vim/vim
A use-after-free flaw in Vim allows attackers to potentially execute arbitrary code or cause a denial of service via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-4752?
CVE-2023-4752 is a high-severity use after free vulnerability in Apple Macos, published on 4 Sep 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Use After Free in GitHub repository vim/vim prior to 9.0.1858.
Weakness: CWE-416
Which versions are affected by CVE-2023-4752?
It affects 5 products.
Linux distribution packages (24)
vim-X11 AlmaLinux:9 | All versions | 2:8.2.2637-22.el9_6 |
vim-common AlmaLinux:9 | All versions | 2:8.2.2637-22.el9_6 |
vim-enhanced AlmaLinux:9 | All versions | 2:8.2.2637-22.el9_6 |
vim-filesystem AlmaLinux:9 | All versions | 2:8.2.2637-22.el9_6 |
vim-minimal AlmaLinux:9 | All versions | 2:8.2.2637-22.el9_6 |
vim-X11 Red Hat:enterprise_linux:9::appstream | All versions | 2:8.2.2637-22.el9_6 |
vim-X11-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:8.2.2637-22.el9_6 |
vim-common Red Hat:enterprise_linux:9::appstream | All versions | 2:8.2.2637-22.el9_6 |
vim-common-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:8.2.2637-22.el9_6 |
vim-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:8.2.2637-22.el9_6 |
vim-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 2:8.2.2637-22.el9_6 |
vim-enhanced Red Hat:enterprise_linux:9::appstream | All versions | 2:8.2.2637-22.el9_6 |
vim-enhanced-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:8.2.2637-22.el9_6 |
vim-minimal-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:8.2.2637-22.el9_6 |
vim Red Hat:enterprise_linux:9::baseos | All versions | 2:8.2.2637-22.el9_6 |
vim-X11-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 2:8.2.2637-22.el9_6 |
vim-common-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 2:8.2.2637-22.el9_6 |
vim-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 2:8.2.2637-22.el9_6 |
vim-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 2:8.2.2637-22.el9_6 |
vim-enhanced-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 2:8.2.2637-22.el9_6 |
vim-filesystem Red Hat:enterprise_linux:9::baseos | All versions | 2:8.2.2637-22.el9_6 |
vim-minimal Red Hat:enterprise_linux:9::baseos | All versions | 2:8.2.2637-22.el9_6 |
vim-minimal-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 2:8.2.2637-22.el9_6 |
vim Rocky Linux:9 | All versions | 2:8.2.2637-22.el9_6 |
Products include Apple Macos, Debian Debian Linux, Fedoraproject Fedora, Neovim Neovim, Vim Vim.
How do I fix CVE-2023-4752?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-4752 being exploited?
There is no known exploitation of CVE-2023-4752 in the wild and no public exploit code.
Other vulnerabilities in Apple Macos
Sources
Also known as ALPINE-CVE-2023-4752, ALSA-2025:7440, AZL-28660, BELL-CVE-2023-4752, DEBIAN-CVE-2023-4752, GHSA-5pgr-2gf9-wh94 and 3 more.