{"id":"CVE-2021-4166","title":"vim is vulnerable to Out-of-bounds Read","summary":"vim is vulnerable to Out-of-bounds Read","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","cwe":["CWE-125","CWE-125"],"vendor":"vim","product":"vim","affected":["vim < 8.2.3884","enterprise_linux = 8.0","factory","linux_enterprise = 12.0","linux_enterprise = 15.0","debian_linux = 9.0","debian_linux = 10.0","debian_linux = 11.0","fedora = 34","fedora = 35","mac_os_x = 10.15.7","macos < 12.3","macos >= 11.0, < 11.6.6","macos = 10.15.7"],"patched":["vim 8.2.3884","macos 11.6.6"],"published":"2021-12-25","updated":"2026-10-08","sourceUpdated":"2026-10-08T21:17:42.890","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-4166","references":[{"url":"http://seclists.org/fulldisclosure/2022/Jul/14","label":"security@huntr.dev"},{"url":"http://seclists.org/fulldisclosure/2022/Mar/29","label":"security@huntr.dev"},{"url":"http://seclists.org/fulldisclosure/2022/May/35","label":"security@huntr.dev"},{"url":"http://www.openwall.com/lists/oss-security/2022/01/15/1","label":"security@huntr.dev"},{"url":"https://github.com/vim/vim/commit/6f98371532fcff911b462d51bc64f2ce8a6ae682","label":"security@huntr.dev"},{"url":"https://huntr.dev/bounties/229df5dd-5507-44e9-832c-c70364bdf035","label":"security@huntr.dev"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/","label":"security@huntr.dev"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/","label":"security@huntr.dev"},{"url":"https://security.gentoo.org/glsa/202208-32","label":"security@huntr.dev"},{"url":"https://support.apple.com/kb/HT213183","label":"security@huntr.dev"},{"url":"https://support.apple.com/kb/HT213256","label":"security@huntr.dev"},{"url":"https://support.apple.com/kb/HT213343","label":"security@huntr.dev"},{"url":"http://seclists.org/fulldisclosure/2022/Jul/14","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2022/Mar/29","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2022/May/35","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2022/01/15/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/vim/vim/commit/6f98371532fcff911b462d51bc64f2ce8a6ae682","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://huntr.dev/bounties/229df5dd-5507-44e9-832c-c70364bdf035","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202208-32","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213183","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213256","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT213343","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.01578,"epssPercentile":0.74729,"ingestedAt":"2026-10-08T22:11:53.744Z","slug":"CVE-2021-4166","body":"## Overview\n\nvim is vulnerable to Out-of-bounds Read\n\n## Affected\n\n- `vim < 8.2.3884`\n- `enterprise_linux = 8.0`\n- `factory`\n- `linux_enterprise = 12.0`\n- `linux_enterprise = 15.0`\n- `debian_linux = 9.0`\n- `debian_linux = 10.0`\n- `debian_linux = 11.0`\n- `fedora = 34`\n- `fedora = 35`\n- `mac_os_x = 10.15.7`\n- `macos < 12.3`\n- `macos >= 11.0, < 11.6.6`\n- `macos = 10.15.7`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `vim 8.2.3884`\n- `macos 11.6.6`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}