CVE intelligence

CVE-2024-41965

Vulnerability intelligence

Published Aug 1, 2024Sources checked Nov 11, 2026

4.2MEDIUMCVSS out of 10

What this means

Review the available evidence

CVE-2024-41965 and is rated Medium severity with a CVSS score of 4.2. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Aug 12, 2026

CBL-Mariner Releases

Vendor-listed releases

9.0.2121-4
9.0.2190-4

CISA KEVNot listedBased on the latest collected catalog

EPSS0.3%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2024-41965?

Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer.

If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash.

The issue has been fixed as of Vim patch v9.1.0648.

Source: NVD