{"id":"CVE-2021-4136","title":"vim is vulnerable to Heap-based Buffer Overflow","summary":"vim is vulnerable to Heap-based Buffer Overflow","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-122","CWE-787"],"vendor":"vim","product":"vim","affected":["vim < 8.2.3847","fedora = 34","fedora = 35","mac_os_x >= 10.15, < 10.15.7","mac_os_x = 10.15.7","macos >= 11.0, < 11.6.6","macos >= 12.0, < 12.3"],"patched":["vim 8.2.3847","mac_os_x 10.15.7","macos 12.3"],"published":"2021-12-19","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:17:14.317","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-4136","references":[{"url":"http://seclists.org/fulldisclosure/2022/Jul/14","label":"security@huntr.dev"},{"url":"http://seclists.org/fulldisclosure/2022/Mar/29","label":"security@huntr.dev"},{"url":"http://seclists.org/fulldisclosure/2022/May/35","label":"security@huntr.dev"},{"url":"http://www.openwall.com/lists/oss-security/2022/01/15/1","label":"security@huntr.dev"},{"url":"https://github.com/vim/vim/commit/605ec91e5a7330d61be313637e495fa02a6dc264","label":"security@huntr.dev"},{"url":"https://huntr.dev/bounties/5c6b93c1-2d27-4e98-a931-147877b8c938","label":"security@huntr.dev"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/","label":"security@huntr.dev"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/","label":"security@huntr.dev"},{"url":"https://security.gentoo.org/glsa/202208-32","label":"security@huntr.dev"},{"url":"https://support.apple.com/kb/HT213183","label":"security@huntr.dev"},{"url":"https://support.apple.com/kb/HT213256","label":"security@huntr.dev"},{"url":"https://support.apple.com/kb/HT213343","label":"security@huntr.dev"},{"url":"http://seclists.org/fulldisclosure/2022/Jul/14","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2022/Mar/29","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2022/May/35","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2022/01/15/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/vim/vim/commit/605ec91e5a7330d61be313637e495fa02a6dc264","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://huntr.dev/bounties/5c6b93c1-2d27-4e98-a931-147877b8c938","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202208-32","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213183","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213256","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213343","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.01831,"epssPercentile":0.78233,"ingestedAt":"2026-10-08T23:16:47.328Z","slug":"CVE-2021-4136","body":"## Overview\n\nvim is vulnerable to Heap-based Buffer Overflow\n\n## Affected\n\n- `vim < 8.2.3847`\n- `fedora = 34`\n- `fedora = 35`\n- `mac_os_x >= 10.15, < 10.15.7`\n- `mac_os_x = 10.15.7`\n- `macos >= 11.0, < 11.6.6`\n- `macos >= 12.0, < 12.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `vim 8.2.3847`\n- `mac_os_x 10.15.7`\n- `macos 12.3`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}