CVE-2023-48235

Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `060623e` which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-190

• http://www.openwall.com/lists/oss-security/2023/11/16/1Mailing List
• https://github.com/vim/vim/commit/060623e4a3bc72b011e7cd92bedb3bfb64e06200Patch
• https://github.com/vim/vim/security/advisories/GHSA-6g74-hr6q-pr8gVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20231227-0007/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/11/16/1Mailing List
• https://github.com/vim/vim/commit/060623e4a3bc72b011e7cd92bedb3bfb64e06200Patch
• https://github.com/vim/vim/security/advisories/GHSA-6g74-hr6q-pr8gVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20231227-0007/Third Party Advisory

Published

Nov 16, 2023

Last Modified

Jun 23, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4823The WP Meta and Date Remover WordPress plugin before 2.2.0 p…5.4
• CVE-2023-48230Cap'n Proto is a data interchange format and capability-base…9.8
• CVE-2023-48231Vim is an open source command line text editor. When closing…4.3
• CVE-2023-48232Vim is an open source command line text editor. A floating p…4.3
• CVE-2023-48233Vim is an open source command line text editor. If the count…4.3
• CVE-2023-48234Vim is an open source command line text editor. When getting…4.3
• CVE-2023-48236Vim is an open source command line text editor. When using t…4.3
• CVE-2023-48237Vim is an open source command line text editor. In affected …4.3
• CVE-2023-48238joaquimserafim/json-web-token is a javascript library use to…7.5
• CVE-2023-48239Nextcloud Server provides data storage for Nextcloud, an ope…7.1
• CVE-2023-4824The WooHoo Newspaper Magazine theme does not have CSRF check…8.8
• CVE-2023-48240XWiki Platform is a generic wiki platform. The rendered diff…8.8