CVE-2024-41957

Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags, but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647

• CWE-415
• CWE-415

• https://github.com/vim/vim/commit/8a0bbe7b8aad6f8da28dee218c01bc8a0185aPatch
• https://github.com/vim/vim/security/advisories/GHSA-f9cr-gv85-hcr4Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Sep/33
• http://www.openwall.com/lists/oss-security/2024/08/01/1
• https://security.netapp.com/advisory/ntap-20241129-0007/

Published

Aug 1, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41951Pheonix App is a Python application designed to streamline v…4.4
• CVE-2024-41952Zitadel is an open source identity management system. ZITADE…5.3
• CVE-2024-41953Zitadel is an open source identity management system. ZITADE…6.1
• CVE-2024-41954FOG is a cloning/imaging/rescue suite/inventory management s…7.8
• CVE-2024-41955Mobile Security Framework (MobSF) is a security research pla…5.4
• CVE-2024-41956Soft Serve is a self-hostable Git server for the command lin…8.1
• CVE-2024-41958mailcow: dockerized is an open source groupware/email suite …7.2
• CVE-2024-41959mailcow: dockerized is an open source groupware/email suite …6.1
• CVE-2024-4196An improper input validation vulnerability was discovered i…9.8
• CVE-2024-41960mailcow: dockerized is an open source groupware/email suite …4.8
• CVE-2024-41961Elektra is an opinionated Openstack Dashboard for Operators …9.6
• CVE-2024-41962Bostr is an nostr relay aggregator proxy that acts like a re…6.3