CVE-2023-48706

Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.

• CWE-416

• https://www.openwall.com/lists/oss-security/2023/11/22/3Mailing List, Patch, Third Party Advisory
• https://github.com/gandalf4a/crash_report/blob/main/vim/vim_huafExploit
• https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bbPatch
• https://github.com/vim/vim/pull/13552Issue Tracking, Patch
• https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53qExploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNMFS3IH74KEMMESOA3EOB6MZ56TWGFF/Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVA7K73WHQH4KVFDJQ7ELIUD2WK5ZT5E/Vendor Advisory
• https://security.netapp.com/advisory/ntap-20240105-0001/Vendor Advisory
• https://www.openwall.com/lists/oss-security/2023/11/22/3Mailing List, Patch, Third Party Advisory
• https://github.com/gandalf4a/crash_report/blob/main/vim/vim_huafExploit
• https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bbPatch
• https://github.com/vim/vim/pull/13552Issue Tracking, Patch
• https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53qExploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNMFS3IH74KEMMESOA3EOB6MZ56TWGFF/Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVA7K73WHQH4KVFDJQ7ELIUD2WK5ZT5E/Vendor Advisory
• https://security.netapp.com/advisory/ntap-20240105-0001/Vendor Advisory

Published

Nov 22, 2023

Last Modified

Sep 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-48700The Nautobot Device Onboarding plugin uses the netmiko and N…6.5
• CVE-2023-48701Statamic CMS is a Laravel and Git powered content management…6.1
• CVE-2023-48702Jellyfin is a system for managing and streaming media. Prior…7.2
• CVE-2023-48703RobotsAndPencils go-saml, a SAML client library written in G…7.5
• CVE-2023-48704ClickHouse is an open-source column-oriented database manage…7.5
• CVE-2023-48705Nautobot is a Network Source of Truth and Network Automation…5.4
• CVE-2023-48707CodeIgniter Shield is an authentication and authorization pr…6.5
• CVE-2023-48708CodeIgniter Shield is an authentication and authorization pr…6.5
• CVE-2023-48709iTop is an IT service management platform. When exporting d…8
• CVE-2023-4871A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2023-48710iTop is an IT service management platform. Files from the `…9.8
• CVE-2023-48711google-translate-api-browser is an npm package which interfa…3.7