Double free in Vim - CVE-2024-41965

Vulnerability identifier: #VU95160

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-41965

CWE-ID: CWE-415

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary error within the dialog_changed() function. A remote attacker can trick the victim to open a specially crafted file, trigger a double free error and crash the application.

Vim
openEuler
Fedora
vim
vim-X11
vim-common
vim-debuginfo
vim-debugsource
vim-enhanced
vim-minimal
vim-filesystem

Install updates from vendor's website.

Vim - update to 9.1.0648
vim - update to 9.0-24
vim-X11 - update to 9.0-24
vim-common - update to 9.0-24
vim-debuginfo - update to 9.0-24
vim-debugsource - update to 9.0-24
vim-enhanced - update to 9.0-24
vim-minimal - update to 9.0-24
vim-filesystem - update to 9.0-24
vim - addressed in versions 9.1.660-1.fc39, 9.1.660-1.fc40

• https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f
• https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c

• Double-free in Vim
• Fedora 40 update for vim
• Fedora 39 update for vim
• openEuler update for vim