Vim Vulnerability: Memory Access Issue Leading to Potential Crashes

vim Updated 02 Oct 2025

Summary

16/11/2023

Disclosed on

N/A

Severity

Yes i

Fix available

Medium

Severity

4.3

CVSS Score

ALPINE-CVE-2023-48231: Vim is an open source command line text editor. Affects vim versions < 9.0.2112-r0. Fixed in 9.0.2112-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Vim is a widely used open-source command line text editor known for its efficiency and versatility in text manipulation. It supports various programming languages and offers features such as syntax highlighting, multi-level undo, and extensive plugin support. However, Vim has been found to have a vulnerability that affects its stability when closing windows, which could lead to application crashes.

Vulnerability Detail

The vulnerability identified as CVE-2023-48231 occurs when Vim attempts to access a window structure that has already been freed upon closing a window. This flaw can lead to application crashes, although exploitation beyond this has not been demonstrated. The issue was addressed in a commit that has been included in the release version 9.0.2106, indicating that users should upgrade to avoid potential instability.

How To Fix

Minimum fixed version

9.0.2112-r0

This is the first release that contains the fix.

sudo apk add --upgrade vim

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

Currently, there are no known workarounds for this vulnerability other than upgrading to the patched version of Vim.

Conclusion

In summary, CVE-2023-48231 is a significant vulnerability in Vim that can lead to application crashes when closing windows. Users are strongly advised to upgrade to the patched version 9.0.2112-r0 to ensure stability and security. Regular updates and monitoring for vulnerabilities are essential for maintaining software integrity.

See every vulnerability recorded for vim →