{"id":"CVE-2021-4187","title":"Use After Free in vim/vim","summary":"vim is vulnerable to Use After Free","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H","cvssSource":"cna","cwe":["CWE-416"],"vendor":"vim","product":"vim/vim","affected":["vim/vim >= unspecified < 8.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T18:09:59.282873Z"},"published":"2021-12-29","updated":"2026-11-02","sourceUpdated":"2026-11-02T18:10:33.048Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2021-4187","references":[{"url":"https://huntr.dev/bounties/a8bee03a-6e2e-43bf-bee3-4968c5386a2e"},{"url":"https://github.com/vim/vim/commit/4bf1006cae7e87259ccd5219128c3dba75774441"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/","label":"FEDORA-2022-a3d70b50f0"},{"url":"http://www.openwall.com/lists/oss-security/2022/01/15/1","label":"[oss-security] 20220114 Re: 3 new CVE's in vim"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/","label":"FEDORA-2022-48b86d586f"},{"url":"https://support.apple.com/kb/HT213183"},{"url":"http://seclists.org/fulldisclosure/2022/Mar/29","label":"20220314 APPLE-SA-2022-03-14-4 macOS Monterey 12.3"},{"url":"https://support.apple.com/kb/HT213256"},{"url":"http://seclists.org/fulldisclosure/2022/May/35","label":"20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6"},{"url":"https://support.apple.com/kb/HT213343"},{"url":"http://seclists.org/fulldisclosure/2022/Jul/14","label":"20220721 APPLE-SA-2022-07-20-4 Security Update 2022-005 Catalina"},{"url":"https://security.gentoo.org/glsa/202208-32","label":"GLSA-202208-32"}],"tags":["cve.org"],"epss":0.01758,"epssPercentile":0.78104,"ingestedAt":"2026-11-05T19:30:42.767Z","slug":"CVE-2021-4187","body":"## Overview\n\nvim is vulnerable to Use After Free\n\n## Affected\n\n- `vim/vim >= unspecified < 8.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":37.4,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}