{"id":"CLSA-2026-1778260679","summary":"vim: Fix of 7 CVEs","details":"- CVE-2021-3875: fix ml_get error after search with range; clamp\n  ea-\u003eline2 to the buffer length in get_address() so out-of-range\n  addresses do not produce an out-of-bounds read (ex_docmd.c, upstream\n  patch 8.2.3489)\n- CVE-2022-4293: fix crash when dividing the largest negative integer\n  by -1 in num_divide(); detect the LONG_MIN / -1 case and clamp the\n  result (typval.c, upstream patch 9.0.0913)\n- CVE-2023-48231: fix use-after-free in win_close() when an autocmd\n  closes a previously-validated window; re-check window validity\n  before setting w_closing (window.c, upstream patch 9.0.2106)\n- CVE-2023-48235: fix integer overflow in ex address parsing; verify\n  lnum is positive before subtracting from LONG_MAX in get_address()\n  and add e_line_number_out_of_range[] in src/errors.h (ex_docmd.c +\n  errors.h, upstream patches 8.2.3659 + 9.0.2110)\n- CVE-2024-41957: fix use-after-free in tagstack_clear_entry(); use\n  VIM_CLEAR to NULL pointers when freeing the tagstack on win_free\n  (window.c, upstream patch 9.1.0647)\n- CVE-2024-43374: fix use-after-free in alist_add(); lock the current\n  window across the buflist_add() autocmd window so its tagstack\n  reference cannot be freed underneath us (arglist.c, upstream patch\n  9.1.0678)\n- CVE-2024-47814: fix use-after-free when closing a buffer; abort\n  do_ecmd() if the new buffer is marked for deletion via b_locked or\n  b_locked_split (ex_cmds.c, upstream patch 9.1.0764)","modified":"2026-05-27T11:18:14.857232234Z","published":"2026-05-08T17:18:06Z","upstream":["CVE-2021-3875","CVE-2022-4293","CVE-2023-48231","CVE-2023-48235","CVE-2024-41957","CVE-2024-43374","CVE-2024-47814"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1778260679.html"}],"affected":[{"package":{"name":"vim-X11","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/vim-X11?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els24"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778260679.json"}},{"package":{"name":"vim-common","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/vim-common?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els24"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778260679.json"}},{"package":{"name":"vim-enhanced","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/vim-enhanced?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els24"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778260679.json"}},{"package":{"name":"vim-filesystem","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/vim-filesystem?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els24"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778260679.json"}},{"package":{"name":"vim-minimal","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/vim-minimal?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els24"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778260679.json"}}],"schema_version":"1.7.5"}