CVE-2024-41965 Vim < v9.1.0648 has a double-free in dialog_changed()

What is CVE-2024-41965?

CVE-2024-41965 is a medium-severity use after free vulnerability in Netapp Hci Compute Node, published on 1 Aug 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.

Weakness: CWE-415, CWE-416

Which versions are affected by CVE-2024-41965?

It affects 3 products.

Products include Neovim Neovim, Netapp Hci Compute Node, Vim Vim.

How do I fix CVE-2024-41965?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2024-41965 being exploited?

There is no known exploitation of CVE-2024-41965 in the wild and no public exploit code.

Other vulnerabilities in Netapp Hci Compute Node

• CVE-2019-12735 Command injection in n/a High 8.6
• CVE-2022-3591 Use After Free in vim/vim High 7.8
• CVE-2026-45130 Vim: Heap Buffer Overflow in spell file loading Medium 6.6
• CVE-2026-25749 Heap Overflow in Vim Medium 6.6
• CVE-2024-43374 Vim heap-use-after-free in src/arglist.c:207 Medium 4.5

All Netapp Hci Compute Node vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2024-41965, AZL-47355, AZL-47391, BELL-CVE-2024-41965, DEBIAN-CVE-2024-41965, ECHO-9d28-4449-272c and 1 more.