CVE-2026-73071Low· 3.3▾ SunlitVim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
0.1% → 0.2%
Last analysed / modified upstream
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.
vim >= 9.2.0511, < 9.2.0844Upgrade past the affected range:
vim 9.2.0844Connected by shared product, vendor, weakness, or advisory.
CVE-2023-46246Medium· 4.0Vim is an improved version of the good old UNIX editor Vi
CVE-2022-2946High· 7.8Use After Free in GitHub repository vim/vim prior to 9.0.0246.
CVE-2022-2042High· 7.8Use After Free in GitHub repository vim/vim prior to 8.2.
CVE-2022-1616High· 7.8Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895
CVE-2022-2345High· 7.8Use After Free in GitHub repository vim/vim prior to 9.0.0046.
CVE-2021-3974High· 7.8vim is vulnerable to Use After Free