CVE-2021-4069

A heap use-after-free flaw was found in Vim's ex_open() function in src/ex_docmd.c file. This flaw allows an attacker to trick the victim into opening a specially crafted file that triggers a use-after-free error, allowing the attacker to compromise the system and execute arbitrary code.

This flaw has received a Low Severity rating because in order for the flaw to be triggered, a victim user must run an arbitrary input file (most likely provided by a malicious user) in Vim script mode using -s {scriptin}. Users running arbitrary Vim scripts are already open to security risks and this is NEVER recommended. Doing so with a privileged account is even more risky and not recommended.

This flaw does not reproduce on versions of Vim shipped with Red Hat Enterprise Linux 7 or 8. Therefore, it has been marked as notaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.