VDB
ALPINE-CVE-2024-41965
ALPINE-CVE-2024-41965
PUBLISHED
CVSS 4.199999809265137 MEDIUM
Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.
Risk Scores
CVSS v3.1
4.199999809265137
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.23 | vim | 9.1.0414-r0, 9.1.0-r2, 9.1.0-r1 |
| Alpine:v3.20 | vim | 8.2.2822-r1, 0, 7.2.284-r0 |
| Alpine:v3.21 | vim | 0, 7.2.284-r0, 7.2.394-r0 |
| Alpine:v3.22 | vim | 9.1.0414-r0, 9.1.0-r2, 9.1.0-r1 |
Timeline
- Aug 1, 2024 CVE Published
- Dec 3, 2025 CVE Updated
- Apr 30, 2026 Distribution Patch