CVE-2021-3968

HighCVSS 8.0/10Last modified Oct 8, 2026

Description

vim is vulnerable to Heap-based Buffer Overflow

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

Vendor	Product	Versions
vim	vim/vim	>= unspecified, < 8.2.3610

References

http://www.openwall.com/lists/oss-security/2022/01/15/1Mailing List, Third Party Advisory
https://github.com/vim/vim/commit/a062006b9de0b2947ab5fb376c6e67ef92a8cd69Patch, Third Party Advisory
https://huntr.dev/bounties/00d62924-a7b4-4a61-ba29-acab2eaa1528Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IH2LS2DXBTYOCWGAKFMBF3HTWWXPBEFL/
https://security.gentoo.org/glsa/202208-32Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/15/1Mailing List, Third Party Advisory
https://github.com/vim/vim/commit/a062006b9de0b2947ab5fb376c6e67ef92a8cd69Patch, Third Party Advisory
https://huntr.dev/bounties/00d62924-a7b4-4a61-ba29-acab2eaa1528Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IH2LS2DXBTYOCWGAKFMBF3HTWWXPBEFL/
https://security.gentoo.org/glsa/202208-32Third Party Advisory

Timeline

Published: Nov 19, 2021
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-396804.4In sec_SHA256_Transform of sha256_core.c, there is a possible way to read heap data due to uninitialized data. This could lead to local info CVE-2021-396817.8In delete_protocol of main.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of p CVE-2021-396827.8In mgm_alloc_page of memory_group_manager.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to lo CVE-2021-396836.7In copy_from_mbox of sss_ice_util.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalat CVE-2021-396847.8In target_init of gs101/abl/target/slider/target.c, there is a possible allocation of RWX memory due to a logic error in the code. This coul CVE-2021-396857.8In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lea CVE-2021-396867.0In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead CVE-2021-396875.5In HandleTransactionIoEvent of actuator_driver.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to CVE-2021-396885.5In TBD of TBD, there is a possible out of bounds read due to TBD. This could lead to local information disclosure with no additional executi CVE-2021-396896.7In multiple functions of odsign_main.cpp, there is a possible way to persist system attack due to a logic error in the code. This could lead CVE-2021-39697.0A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation,CVE-2021-396905.5In setDisplayPadding of WallpaperManagerService.java, there is a possible way to cause a persistent DoS due to improper input validation. Th