Description
Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags,
but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vim | vim | < 9.1.0647 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 2:9.1.0698-1 | — |
| Debian 13 | vim | 2:9.1.0698-1 | — |
| Debian 12 | vim | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | vim | 2:9.1.0016-1ubuntu7.2 | USN-6993-1 |
| Ubuntu 22.04 LTS | vim | 2:8.2.3995-1ubuntu2.18 | USN-6993-1 |
| Ubuntu 20.04 LTS | vim | 2:8.1.2269-1ubuntu5.24 | USN-6993-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | vim | 2:8.0.1453-1ubuntu1.13+esm9 | USN-6993-1 |
| Ubuntu Pro 16.04 LTS | vim | 2:7.4.1689-3ubuntu1.5+esm24 | USN-6993-1 |
| Ubuntu Pro 14.04 LTS | vim | 2:7.4.052-1ubuntu3.1+esm18 | USN-6993-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | vim | 9.1.0652-r0 | — |
| Alpine v3.23 | vim | 9.1.0652-r0 | — |
| Alpine v3.22 | vim | 9.1.0652-r0 | — |
| Alpine v3.21 | vim | 9.1.0652-r0 | — |
| Alpine v3.20 | vim | 9.1.0652-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | xxd +6 | 2:9.1.785-1.amzn2023.0.1 | ALAS2023-2024-761 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | vim | 9.0.2190-4 | — |
| Azure Linux 2 (CBL-Mariner) | vim | 9.0.2121-4 | — |
Advisories 5
- USN-6993-1 vim vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- WID-SEC-2024-1746 vim: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 4, 2025
- WID-SEC-2024-2154 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 11, 2025
- ALAS2023-2024-761 Moderate: vim security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 14, 2024
- NCSC-2024-0381 Kwetsbaarheden verholpen in Apple MacOS NCSC-NL (Netherlands) · Sep 26, 2024