Skip to content
OpenAdvisories
Medium · 4.5 CVE-2024-41957 EUVD-2024-39323

Vim double free in src/alloc.c:616

Published Aug 1, 2024 · Updated Nov 4, 2025 · Assigned by GitHub_M

Description

Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags,
but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647

Affected products

VendorProductAffectedFixed
vim vim < 9.1.0647 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 vim 2:9.1.0698-1 —
Debian 13 vim 2:9.1.0698-1 —
Debian 12 vim No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS vim 2:9.1.0016-1ubuntu7.2 USN-6993-1
Ubuntu 22.04 LTS vim 2:8.2.3995-1ubuntu2.18 USN-6993-1
Ubuntu 20.04 LTS vim 2:8.1.2269-1ubuntu5.24 USN-6993-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS vim 2:8.0.1453-1ubuntu1.13+esm9 USN-6993-1
Ubuntu Pro 16.04 LTS vim 2:7.4.1689-3ubuntu1.5+esm24 USN-6993-1
Ubuntu Pro 14.04 LTS vim 2:7.4.052-1ubuntu3.1+esm18 USN-6993-1
ReleasePackageFixed inAdvisory
Alpine v3.24 vim 9.1.0652-r0 —
Alpine v3.23 vim 9.1.0652-r0 —
Alpine v3.22 vim 9.1.0652-r0 —
Alpine v3.21 vim 9.1.0652-r0 —
Alpine v3.20 vim 9.1.0652-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 xxd +6 2:9.1.785-1.amzn2023.0.1 ALAS2023-2024-761

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 vim 9.0.2190-4 —
Azure Linux 2 (CBL-Mariner) vim 9.0.2121-4 —

Advisories 5

References