Executive Summary

CVE-2023-4733 is a use‑after‑free flaw in Vim (versions <9.0.1840) that can be triggered by crafted input, potentially allowing an attacker to execute arbitrary code or crash the editor. The vulnerability stems from improper deallocation of memory during buffer handling, leaving dangling pointers. Exploitation requires local or remote access to the vulnerable Vim instance and is mitigated by applying the 9.0.1840 patch or later.

---

Authoritative CVE Metadata - CVSS Base Score: 7.8 (HIGH) - Published: 2023-09-04T14:15:07.563 - Last Modified: 2026-09-18T15:38:16.497

Original Description: Use After Free in GitHub repository vim/vim prior to 9.0.1840.

"We know what we are, but know not what we may be."

— William Shakespeare