---
id: CVE-2021-4173
title: Use After Free in vim/vim
summary: vim is vulnerable to Use After Free
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-416
vendor: vim
product: vim/vim
affected:
  - vim/vim >= unspecified < 8.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T18:08:19.192757Z'
published: '2021-12-27'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T18:09:28.884Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2021-4173'
references:
  - url: 'https://huntr.dev/bounties/a1b236b9-89fb-4ccf-9689-ba11b471e766'
  - url: 'https://github.com/vim/vim/commit/9c23f9bb5fe435b28245ba8ac65aa0ca6b902c04'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/
    label: FEDORA-2022-a3d70b50f0
  - url: 'http://www.openwall.com/lists/oss-security/2022/01/15/1'
    label: '[oss-security] 20220114 Re: 3 new CVE''s in vim'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/
    label: FEDORA-2022-48b86d586f
  - url: 'https://support.apple.com/kb/HT213183'
  - url: 'http://seclists.org/fulldisclosure/2022/Mar/29'
    label: 20220314 APPLE-SA-2022-03-14-4 macOS Monterey 12.3
  - url: 'https://support.apple.com/kb/HT213256'
  - url: 'http://seclists.org/fulldisclosure/2022/May/35'
    label: 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6
  - url: 'https://support.apple.com/kb/HT213343'
  - url: 'http://seclists.org/fulldisclosure/2022/Jul/14'
    label: 20220721 APPLE-SA-2022-07-20-4 Security Update 2022-005 Catalina
  - url: 'https://security.gentoo.org/glsa/202208-32'
    label: GLSA-202208-32
tags:
  - cve.org
epss: 0.01758
epssPercentile: 0.78104
ingestedAt: '2026-11-05T19:30:42.767Z'
---

## Overview

vim is vulnerable to Use After Free

## Affected

- `vim/vim >= unspecified < 8.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.