VDB
CVE-2023-4735
CVE-2023-4735
PUBLISHED
CVSS 4.8 MEDIUM
Out-of-bounds Write in vim/vim
Reported by @huntrdev · Published September 2, 2023
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| vim-filesystem | Amazon Linux | 2:9.0.1882-1.amzn2023.0.1, 2:9.0.1882-1.amzn2.0.1 |
| vim-enhanced | Amazon Linux | 2:9.0.1882-1.amzn2023.0.1, 2:9.0.1882-1.amzn2.0.1 |
| xxd | Amazon Linux | 2:9.0.1882-1.amzn2023.0.1, 2:9.0.1882-1.amzn2.0.1 |
| vim-default-editor | Amazon Linux | 2:9.0.1882-1.amzn2023.0.1 |
| vim-X11 | Amazon Linux | 2:9.0.1882-1.amzn2.0.1 |
| vim | Alpine | 9.0.2073-r0, 9.0.1888-r0 |
| vim-minimal | Amazon Linux | 2:9.0.1882-1.amzn2023.0.1, 2:9.0.1882-1.amzn2.0.1 |
| vim-data | Amazon Linux | 2:9.0.1882-1.amzn2023.0.1, 2:9.0.1882-1.amzn2.0.1 |
| vim-common | Amazon Linux | 2:9.0.1882-1.amzn2023.0.1, 2:9.0.1882-1.amzn2.0.1 |
| vim | vim | 9.0.1847 |
| vim/vim | vim | 9.0.1847 |
Risk scores
CVSS 3.0
4.8
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected products
| Vendor | Product | Versions |
|---|---|---|
| vim | vim/vim | unspecified |
| amazon:2 | vim-filesystem | 0 |
| amazon:2 | vim-enhanced | 0 |
| amazon:2 | xxd | 0 |
| amazon:2023 | vim-filesystem | 0 |
| amazon:2023 | vim-default-editor | 0 |
| vim | vim/vim | * |
| amazon:2 | vim-X11 | 0 |
| alpine | vim | 0, 0 |
| amazon:2023 | vim-minimal | 0 |
| amazon:2023 | vim-data | 0 |
| amazon:2 | vim-data | 0 |
| amazon:2023 | vim-enhanced | 0 |
| amazon:2023 | vim-common | 0 |
| amazon:2 | vim-common | 0 |
| amazon:2 | vim-minimal | 0 |
| amazon:2023 | xxd | 0 |
Timeline
- Sep 2, 2023 CVE Published
- Sep 3, 2023 EPSS Score (30 in total, the first dated here)
- May 9, 2024 PoC Published
- Mar 30, 2025 CVE Updated
- Jan 28, 2026 Security Advisory (2 in total, the first dated here)
- Jul 31, 2026 Coalition ESS Score
- Nov 4, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-4735
vulnetix vdb fixes CVE-2023-4735Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-4735/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart