VI
Product
vim
260
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 170Medium 71Low 4
Watch
Add vim to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3973 | 7.8 | Nov 19 | Heap-based Buffer Overflow in vim/vim Affected: before 8.2.3611 |
| CVE-2021-3974 | 7.8 | Nov 19 | Use After Free in vim/vim Affected: before 8.2.3612 |
| CVE-2021-3927 | 7.8 | Nov 5 | Heap-based Buffer Overflow in vim/vim Affected: before 8.2.3581 |
| CVE-2021-3928 | 7.8 | Nov 5 | Use of Uninitialized Variable in vim/vim Affected: before 8.2.3582 |
| CVE-2021-3903 | 7.8 | Oct 27 | vim is vulnerable to Heap-based Buffer Overflow Affected: before 8.2.3564 |
| CVE-2021-3872 | 7.8 | Oct 19 | vim is vulnerable to Heap-based Buffer Overflow Affected: before 8.2.3487 |
| CVE-2021-3778 | 7.8 | Sep 15 | vim is vulnerable to Heap-based Buffer Overflow Affected: before 8.2.3409 |
| CVE-2021-3770 | 7.8 | Sep 6 | vim is vulnerable to Heap-based Buffer Overflow Affected: before 8.2.3408 |
| CVE-2019-20079 | 7.8 | Dec 30 | The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory Affected: 8.1.2121 before 8.1.2136 |
| CVE-2017-11109 | 7.8 | Jul 8 | Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file Affected: 8.0 |
| CVE-2016-1248 | 7.8 | Nov 23 | vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a… Affected: through 8.0.0055 |
| CVE-2026-51401 | 7.7 | Aug 4 | An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c Affected: through 9.2.0389 |
| CVE-2026-26269 | 7.5 | Feb 13 | Vim has a Netbeans specialKeys Stack Buffer Overflow Affected: < 9.1.2148 |
| CVE-2023-5344 | 7.5 | Oct 2 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969 Affected: before 9.0.1969 |
| CVE-2022-3705 | 7.5 | Oct 26 | vim autocmd quickfix.c qf_update_buffer use after free Affected: before 9.0.0805 |
| CVE-2022-1620 | 7.5 | May 8 | NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in vim/vim Affected: before 8.2.4901 |
| CVE-2026-73072 | 7.3 | Aug 11 | Vim: Heap Buffer Overflow when Loading a Spell File Affected: < 9.2.0846 |
| CVE-2026-57453 | 7.3 | Jun 25 | Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction Affected: >= 9.1.1784, < 9.2.0678 |
| CVE-2026-33412 | 7.3 | Mar 24 | Vim affected by Command injection via newline in glob() Affected: < 9.2.0202 |
| CVE-2021-3796 | 7.3 | Sep 15 | vim is vulnerable to Use After Free Affected: before 8.2.3428 |
| CVE-2026-35177 | 7.1 | Apr 6 | Path traversal issue with zip.vim in Vim Affected: < 9.2.0280 |
| CVE-2025-27423 | 7.1 | Mar 3 | Vim is an open source, command line text editor Affected: 9.1.0858 before 9.1.1164 |
| CVE-2022-2287 | 7.1 | Jul 2 | Out-of-bounds Read in vim/vim Affected: before 9.0.0021 |
| CVE-2022-0393 | 7.1 | Jan 28 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2 Affected: before 8.2.4233 |
| CVE-2021-4166 | 7.1 | Dec 25 | Out-of-bounds Read in vim/vim Affected: before 8.2.3884 |
| CVE-2026-46483 | 7.0 | May 15 | Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag Affected: < 9.2.479 |
| CVE-2026-73074 | 6.7 | Aug 11 | Vim: Heap Buffer Overflow in Text Property Handling Affected: < 9.2.0841 |
| CVE-2026-41411 | 6.6 | Apr 24 | Vim: Command injection via backtick expansion in tag filenames Affected: < 9.2.0357 |
| CVE-2026-28419 | 6.6 | Feb 27 | Vim has Heap-based Buffer Underflow in Emacs tags parsing Affected: < 9.2.0075 |
| CVE-2026-25749 | 6.6 | Feb 6 | Heap Overflow in Vim Affected: < 9.1.2132 |
| CVE-2023-1175 | 6.6 | Mar 4 | Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378 Affected: before 9.0.1378 |
| CVE-2023-1170 | 6.6 | Mar 3 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376 Affected: before 9.0.1376 |
| CVE-2022-0213 | 6.6 | Jan 14 | Heap-based Buffer Overflow in vim/vim Affected: before 8.2 |
| CVE-2026-57451 | 6.1 | Jun 25 | Vim: Out-of-bounds Read in Text Property Count Affected: < 9.2.0670 |
| CVE-2026-57454 | 6.1 | Jun 25 | Vim: Out-of-bounds Read with Text Properties Affected: >= 9.2.0320, < 9.2.0679 |
| CVE-2026-73070 | 5.5 | Aug 11 | Vim: Stack Buffer Overflow in the Vim Socket Server Affected: < 9.2.0842 |
| CVE-2026-59857 | 5.5 | Jul 9 | Vim: Out-of-bounds Write in SAL Soundfolding Affected: < 9.2.0725 |
| CVE-2026-55892 | 5.5 | Jun 25 | Vim: Out-of-bounds Write in Spell File Prefix Dump Affected: < 9.2.0662 |
| CVE-2026-57452 | 5.5 | Jun 25 | Vim: Out-of-bounds Read with libsodium-encrypted Files Affected: < 9.2.0671 |
| CVE-2026-45130 | 5.5 | May 8 | Vim: Heap Buffer Overflow in spell file loading Affected: < 9.2.0450 |
| CVE-2026-32249 | 5.5 | Mar 12 | NFA regex engine NULL pointer dereference affects Vim < 9.2.0137 Affected: >= 9.1.0011, < 9.2.0137 |
| CVE-2026-28418 | 5.5 | Feb 27 | Vim has Heap-based Buffer Overflow in Emacs tags parsing Affected: < 9.2.0074 |
| CVE-2025-9390 | 5.5 | Aug 24 | vim xxd xxd.c main buffer overflow Affected: 9.1.1459 before 9.1.1616 |
| CVE-2025-9389 | 5.5 | Aug 24 | vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption Affected: 9.1.0000 |
| CVE-2025-24014 | 5.5 | Jan 20 | Vim is an open source, command line text editor Affected: before 9.1.1043 |
| CVE-2025-22134 | 5.5 | Jan 13 | When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and… Affected: through 9.1.1003 |
| CVE-2024-45306 | 5.5 | Sep 2 | heap-buffer-overflow in Vim Affected: >= 9.1.0038, < 9.1.0707 |
| CVE-2024-43790 | 5.5 | Aug 22 | Vim is an open source command line text editor Affected: 9.1.0425 before 9.1.0689 |
| CVE-2023-46246 | 5.5 | Oct 27 | Vim is an improved version of the good old UNIX editor Vi Affected: before 9.0.2068 |
| CVE-2023-5441 | 5.5 | Oct 5 | NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960 Affected: before 9.0.1994 |
