CVE-2024-45306 | heap-buffer-overflow in Vim

Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. Back then we assumed this loop is unnecessary. However, this change made it possible that the cursor position stays invalid and points beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at the specified cursor position. It's not quite clear yet, what can lead to this situation that the cursor points to an invalid position. That's why patch v9.1.0707 does not include a test case. The only observed impact has been a program crash. This issue has been addressed in with the patch v9.1.0707. All users are advised to upgrade.

Published: 2024-09-02 Last update: 2024-11-21 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2024-45306 is rated Low Risk (25.7/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.30%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2024-45306

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.05% 0.30% +0.25%
2 2025-11-21 0.16% 0.05% -0.11%
3 2025-11-18 — 0.16% —

Full EPSS history (5 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2024-45306

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
4.5 3.1 MEDIUM
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:L)
Attackers could change some data, but it’s limited—not everything goes.
Availability (A:L)
Might cause slowdowns, glitches, or partial disruption—not a full brick.
 1.0 3.4 [email protected]
5.5 3.1 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 1.8 3.6 [email protected]

Weakness enumeration for CVE-2024-45306

OS Trackers for CVE-2024-45306

vendor priority summary link
alpine medium CVE-2024-45306: 1 source package rows (vim); 8 state rows across 4 repos (3.20-main, 3.21-main, 3.22-main, edge-main); fixed 0, open 8. https://security.alpinelinux.org/vuln/CVE-2024-45306
debian unimportant CVE-2024-45306 unimportant priority: Debian including 1 source packages (vim), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2024-45306
redhat low — https://access.redhat.com/security/cve/CVE-2024-45306
suse medium CVE-2024-45306 severity moderate: SUSE including 283 source package names (1.5.0:vim-data-common-9.1.1101-150500.20.21.1, 1.5.0:vim-small-9.1.1101-150500.20.21.1, …), 859 product×package rows across 298 product lines (Container suse/hpc/warewulf4-x86_64/sle-hpc-node, Container suse/manager/5.0/x86_64/server, … (298 product lines)): Fixed 634, Known Affected 221, Known Not Affected 4. https://www.suse.com/security/cve/CVE-2024-45306/
ubuntu medium CVE-2024-45306 medium priority: Ubuntu including 1 source packages (vim), 7 status rows across 7 suites (bionic, focal, jammy, noble, trusty, upstream, xenial): not-affected 6, released 1. https://ubuntu.com/security/CVE-2024-45306

Affected software / configurations for CVE-2024-45306

Vendor Product Version Raw CPE
vim vim >= 9.1.0038, < 9.1.0707 cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*

References for CVE-2024-45306

cvelogic Threat Intelligence