CVE-2024-41965

Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.

• CWE-416
• CWE-415

• https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48cPatch
• https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2fVendor Advisory
• https://security.netapp.com/advisory/ntap-20241115-0002/

Published

Aug 1, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41959mailcow: dockerized is an open source groupware/email suite …6.1
• CVE-2024-4196An improper input validation vulnerability was discovered i…9.8
• CVE-2024-41960mailcow: dockerized is an open source groupware/email suite …4.8
• CVE-2024-41961Elektra is an opinionated Openstack Dashboard for Operators …9.6
• CVE-2024-41962Bostr is an nostr relay aggregator proxy that acts like a re…6.3
• CVE-2024-41964Kirby is a CMS targeting designers and editors. Kirby allows…8.1
• CVE-2024-41967A low privileged remote attacker may modify the boot mode co…8.1
• CVE-2024-41968A low privileged remote attacker may modify the docker setti…5.4
• CVE-2024-41969A low privileged remote attacker may modify the configuratio…8.8
• CVE-2024-4197An unrestricted file upload vulnerability in Avaya IP Office…9.8
• CVE-2024-41970A low privileged remote attacker may gain access to forbidde…5.7
• CVE-2024-41971A low privileged remote attacker can overwrite an arbitrary …8.1