PT-2024-5765 · Vim+6 · Vim+6

Suyueguo · Published 2024-08-01 · Updated 2026-03-29 · CVE-2024-41957

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.1.0647

Description The issue exists due to a double-free error in the src/alloc.c file, specifically in the tagstack clear entry() function. When a window is closed, the corresponding tagstack data is cleared and freed. However, if the quickfix list belonging to that window points to the same tagstack data, Vim will attempt to free it again, resulting in a double-free/use-after-free access exception. The impact is low, as the user must intentionally execute Vim with several non-default flags, but it may cause a crash of Vim.

Recommendations To resolve the issue, update to Vim version 9.1.0647 or later. As a temporary workaround, consider avoiding the use of non-default flags when executing Vim until a patch is applied.

Exploit

Fix

Use After Free

Double Free

Weakness Enumeration

CWE-416

CWE-415

Related Identifiers

ALT-PU-2024-17009

ALT-PU-2024-17133

ALT-PU-2024-17154

ALT-PU-2024-17456

AZL-47340

AZL-47388

BDU:2024-06478

CVE-2024-41957

ECHO-7439-9991-63CF

GHSA-F9CR-GV85-HCR4

MGASA-2024-0285

OESA-2024-1982

ROSA-SA-2025-2590

USN-6993-1

Affected Products

Alt Linux

Debian

Linuxmint

Apple Macos

Red Os

Ubuntu

Vim

References · 51

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41957.json · Exploit
• https://github.com/vim/vim/security/advisories/GHSA-f9cr-gv85-hcr4 · Vendor Advisory
• https://github.com/vim/vim/commit/8a0bbe7b8aad6f8da28dee218c01bc8a0185a · Patch
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2024-41957 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6993-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-41957 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06478 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-41965 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2024-41957 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-41957 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2024-41957 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-ALPINE-319-CVE-2024-41957 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1982 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-41957 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0285 · Vendor Advisory