CVE-2024-45306

Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. Back then we assumed this loop is unnecessary. However, this change made it possible that the cursor position stays invalid and points beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at the specified cursor position. It's not quite clear yet, what can lead to this situation that the cursor points to an invalid position. That's why patch v9.1.0707 does not include a test case. The only observed impact has been a program crash. This issue has been addressed in with the patch v9.1.0707. All users are advised to upgrade.

• CWE-122
• CWE-787

• https://github.com/vim/vim/commit/396fd1ec2956307755392a1Patch
• https://github.com/vim/vim/releases/tag/v9.1.0038Release Notes
• https://github.com/vim/vim/security/advisories/GHSA-wxf9-c5gx-qrwrThird Party Advisory
• https://security.netapp.com/advisory/ntap-20241004-0007/

Published

Sep 2, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45300alf.io is an open source ticket reservation system for confe…5.9
• CVE-2024-45301Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In …5.3
• CVE-2024-45302RestSharp is a Simple REST and HTTP API Client for .NET. The…7.8
• CVE-2024-45303Discourse Calendar plugin adds the ability to create a dynam…6.1
• CVE-2024-45304Cairo-Contracts are OpenZeppelin Contracts written in Cairo …6.5
• CVE-2024-45305gix-path is a crate of the gitoxide project dealing with git…2.5
• CVE-2024-45307SudoBot, a Discord moderation bot, is vulnerable to privileg…9.8
• CVE-2024-45308HedgeDoc is an open source, real-time, collaborative, markdo…6.5
• CVE-2024-45309OneDev is a Git server with CI/CD, kanban, and packages. A v…7.5
• CVE-2024-4531The Business Card WordPress plugin through 1.0.0 does not ha…7.1
• CVE-2024-45310runc is a CLI tool for spawning and running containers accor…3.6
• CVE-2024-45311Quinn is a pure-Rust, async-compatible implementation of the…7.5