CVE-2023-48231

Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-416

• http://www.openwall.com/lists/oss-security/2023/11/16/1Mailing List
• https://github.com/vim/vim/commit/25aabc2b8ee1e19ced6f4da9d866cf9378fc4c5aPatch
• https://github.com/vim/vim/security/advisories/GHSA-8g46-v9ff-c765Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/Mailing List
• https://security.netapp.com/advisory/ntap-20231227-0008/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/11/16/1Mailing List
• https://github.com/vim/vim/commit/25aabc2b8ee1e19ced6f4da9d866cf9378fc4c5aPatch
• https://github.com/vim/vim/security/advisories/GHSA-8g46-v9ff-c765Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/Mailing List
• https://security.netapp.com/advisory/ntap-20231227-0008/Third Party Advisory

Published

Nov 16, 2023

Last Modified

Jun 23, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-48226OpenReplay is a self-hosted session replay suite. In version…3.5
• CVE-2023-48227Umbraco is an ASP.NET content management system (CMS). Start…4.3
• CVE-2023-48228authentik is an open-source identity provider. When initiali…9.8
• CVE-2023-48229Contiki-NG is an open-source, cross-platform operating syste…7.6
• CVE-2023-4823The WP Meta and Date Remover WordPress plugin before 2.2.0 p…5.4
• CVE-2023-48230Cap'n Proto is a data interchange format and capability-base…9.8
• CVE-2023-48232Vim is an open source command line text editor. A floating p…4.3
• CVE-2023-48233Vim is an open source command line text editor. If the count…4.3
• CVE-2023-48234Vim is an open source command line text editor. When getting…4.3
• CVE-2023-48235Vim is an open source command line text editor. When parsing…4.3
• CVE-2023-48236Vim is an open source command line text editor. When using t…4.3
• CVE-2023-48237Vim is an open source command line text editor. In affected …4.3