CVE-2021-4173
highvim is vulnerable to Use After Free
Vendor / product: Vim — vim
vim is vulnerable to Use After Free
CVSS
7.8
7.8 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2021-12-27 13:15
Modified: 2026-11-02 19:17
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-11-03 07:33 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
vim / vim <8.2.3902
fedoraproject / fedora 34, 35
apple / mac_os_x 10.15.7
apple / macos <12.3, ≥11.0 <11.6.6, 10.15.7
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/vim/vim/commit/9c23f9bb5fe435b28245ba8ac65aa0ca6b902c04
Patch / mitigation: https://github.com/vim/vim/commit/9c23f9bb5fe435b28245ba8ac65aa0ca6b902c04
References
- http://seclists.org/fulldisclosure/2022/Jul/14 security@huntr.dev
- http://seclists.org/fulldisclosure/2022/Mar/29 security@huntr.dev
- http://seclists.org/fulldisclosure/2022/May/35 security@huntr.dev
- http://www.openwall.com/lists/oss-security/2022/01/15/1 security@huntr.dev
- https://github.com/vim/vim/commit/9c23f9bb5fe435b28245ba8ac65aa0ca6b902c04 security@huntr.dev
- https://huntr.dev/bounties/a1b236b9-89fb-4ccf-9689-ba11b471e766 security@huntr.dev
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... security@huntr.dev
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... security@huntr.dev
- https://security.gentoo.org/glsa/202208-32 security@huntr.dev
- https://support.apple.com/kb/HT213183 security@huntr.dev
- https://support.apple.com/kb/HT213256 security@huntr.dev
- https://support.apple.com/kb/HT213343 security@huntr.dev
- http://seclists.org/fulldisclosure/2022/Jul/14 af854a3a-2127-422b-91ae-364da2661108
- http://seclists.org/fulldisclosure/2022/Mar/29 af854a3a-2127-422b-91ae-364da2661108
- http://seclists.org/fulldisclosure/2022/May/35 af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2022/01/15/1 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/vim/vim/commit/9c23f9bb5fe435b28245ba8ac65aa0ca6b902c04 af854a3a-2127-422b-91ae-364da2661108
- https://huntr.dev/bounties/a1b236b9-89fb-4ccf-9689-ba11b471e766 af854a3a-2127-422b-91ae-364da2661108
- https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html af854a3a-2127-422b-91ae-364da2661108
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... af854a3a-2127-422b-91ae-364da2661108
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... af854a3a-2127-422b-91ae-364da2661108
- https://security.gentoo.org/glsa/202208-32 af854a3a-2127-422b-91ae-364da2661108
- https://support.apple.com/kb/HT213183 af854a3a-2127-422b-91ae-364da2661108
- https://support.apple.com/kb/HT213256 af854a3a-2127-422b-91ae-364da2661108
- https://support.apple.com/kb/HT213343 af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-11-03 07:33 UTC · record ↗