CVE-2023-4750

HighCVSS 7.8/10Last modified Sep 17, 2026

Description

Use After Free in GitHub repository vim/vim prior to 9.0.1857.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
vim	vim/vim	>= unspecified, < 9.0.1857

References

http://seclists.org/fulldisclosure/2023/Oct/24Mailing List, Third Party Advisory
https://github.com/vim/vim/commit/fc68299d436cf87453e432daa77b6d545df4d7edPatch
https://huntr.dev/bounties/1ab3ebdf-fe7d-4436-b483-9a586e03b0eaExploit, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I56ITJAFMFAQ2G3BMGTCGM3GS62V2DTR/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFE3LDFRZ7EGWA5AU7YHYL62ELBOFZWQ/Mailing List
https://support.apple.com/kb/HT213984Release Notes, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/24Mailing List, Third Party Advisory
https://github.com/vim/vim/commit/fc68299d436cf87453e432daa77b6d545df4d7edPatch
https://huntr.dev/bounties/1ab3ebdf-fe7d-4436-b483-9a586e03b0eaExploit, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I56ITJAFMFAQ2G3BMGTCGM3GS62V2DTR/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFE3LDFRZ7EGWA5AU7YHYL62ELBOFZWQ/Mailing List
https://support.apple.com/kb/HT213984Release Notes, Third Party Advisory

Timeline

Published: Sep 4, 2023
Last modified: Sep 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-475039.8An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in CVE-2023-475049.8Improper Authentication vulnerability in Elementor Elementor Website Builder allows Accessing Functionality Not Properly Constrained by ACLs CVE-2023-475055.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor.Com Elementor allows Cross-S CVE-2023-475068.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Master slider Master Slider Pro allows CVE-2023-475079.8Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.CVE-2023-475086.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Averta Master Slider Pro plugin <= 3.6.5 versions.CVE-2023-475096.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ioannup Edit WooCommerce Templates plugin <= 1.1.1 versions.CVE-2023-47517.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.CVE-2023-475106.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPSolutions-HQ WPDBSpringClean plugin <= 1.6 versions.CVE-2023-475114.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SO WP Pinyin Slugs plugin <= 2.3.0 versions.CVE-2023-475126.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions.CVE-2023-475135.4Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injectio