{"id":"CVE-2023-1170","title":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.","summary":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.","severity":"medium","cvss":6.6,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","cwe":["CWE-122"],"vendor":"neovim","product":"neovim","affected":["fedora = 36","fedora = 37","fedora = 38","neovim <= 0.8.3","vim < 9.0.1376"],"patched":["vim 9.0.1376"],"published":"2023-03-03","updated":"2026-09-18","sourceUpdated":"2026-09-18T15:37:44.827","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-1170","references":[{"url":"https://github.com/vim/vim/commit/1c73b65229c25e3c1fd8824ba958f7cc4d604f9c","label":"security@huntr.dev"},{"url":"https://huntr.dev/bounties/286e0090-e654-46d2-ac60-29f81799d0a4","label":"security@huntr.dev"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIAKPMKJ4OZ6NYRZJO7YWMNQL2BICLYV/","label":"security@huntr.dev"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE44W6WMMREYCW3GJHPSYP7NK2VT5NY6/","label":"security@huntr.dev"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4KDAU76Z7QNSPKZX2JAJ6O7KIEOXWTL/","label":"security@huntr.dev"},{"url":"https://github.com/vim/vim/commit/1c73b65229c25e3c1fd8824ba958f7cc4d604f9c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://huntr.dev/bounties/286e0090-e654-46d2-ac60-29f81799d0a4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIAKPMKJ4OZ6NYRZJO7YWMNQL2BICLYV/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE44W6WMMREYCW3GJHPSYP7NK2VT5NY6/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4KDAU76Z7QNSPKZX2JAJ6O7KIEOXWTL/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00495,"epssPercentile":0.39871,"ingestedAt":"2026-09-18T15:44:31.546Z","slug":"CVE-2023-1170","body":"## Overview\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.\n\n## Affected\n\n- `fedora = 36`\n- `fedora = 37`\n- `fedora = 38`\n- `neovim <= 0.8.3`\n- `vim < 9.0.1376`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `vim 9.0.1376`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":36.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}