CVE-2023-2610 - Vulnerability Details - OpenCVE

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Vim	Vim

Configuration 1 [-]

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/vim/vim/commit/ab9a2d884b3a4abe319606ea95a5a6d6b01cd73a
https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d
https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html
https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/
https://nvd.nist.gov/vuln/detail/CVE-2023-2610
https://security.netapp.com/advisory/ntap-20241129-0006/
https://support.apple.com/kb/HT213844
https://support.apple.com/kb/HT213845
https://www.cve.org/CVERecord?id=CVE-2023-2610

History

Tue, 23 Jun 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 03 Nov 2025 21:30:00 +0000

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html

Fri, 29 Nov 2024 12:30:00 +0000

Type	Values Removed	Values Added
References		https://security.netapp.com/advisory/ntap-20241129-0006/

MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published: 2023-05-09T00:00:00.000Z

Updated: 2026-06-23T17:19:08.702Z

Reserved: 2023-05-09T00:00:00.000Z

Link: CVE-2023-2610

Vulnrichment

Updated: 2025-11-03T20:35:22.246Z

NVD

Status : Modified

Published: 2023-05-09T22:15:10.197

Modified: 2026-06-17T05:53:00.447

Link: CVE-2023-2610

Redhat

Severity : Low

Publid Date: 2023-05-10T00:00:00Z

Links: CVE-2023-2610 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-2610", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntr_ai", "dateUpdated": "2026-06-23T17:19:08.702Z", "dateReserved": "2023-05-09T00:00:00.000Z", "datePublished": "2023-05-09T00:00:00.000Z"}, "containers": {"cna": {"title": "Integer Overflow or Wraparound in vim/vim", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2023-12-23T07:06:26.300Z"}, "descriptions": [{"lang": "en", "value": "Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532."}], "affected": [{"vendor": "vim", "product": "vim/vim", "versions": [{"version": "unspecified", "lessThan": "9.0.1532", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d"}, {"url": "https://github.com/vim/vim/commit/ab9a2d884b3a4abe319606ea95a5a6d6b01cd73a"}, {"name": "FEDORA-2023-99d2eaac80", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/"}, {"name": "[debian-lts-announce] 20230612 [SECURITY] [DLA 3453-1] vim security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html"}, {"url": "https://support.apple.com/kb/HT213844"}, {"url": "https://support.apple.com/kb/HT213845"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound", "cweId": "CWE-190"}]}], "source": {"advisory": "31e67340-935b-4f6c-a923-f7246bc29c7d", "discovery": "EXTERNAL"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d", "tags": ["x_transferred"]}, {"url": "https://github.com/vim/vim/commit/ab9a2d884b3a4abe319606ea95a5a6d6b01cd73a", "tags": ["x_transferred"]}, {"name": "FEDORA-2023-99d2eaac80", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/"}, {"name": "[debian-lts-announce] 20230612 [SECURITY] [DLA 3453-1] vim security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html"}, {"url": "https://support.apple.com/kb/HT213844", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/kb/HT213845", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20241129-0006/"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:35:22.246Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-2610", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-13T02:16:15.546649Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T17:19:08.702Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d", "tags": ["x_transferred"]}, {"url": "https://github.com/vim/vim/commit/ab9a2d884b3a4abe319606ea95a5a6d6b01cd73a", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/", "name": "FEDORA-2023-99d2eaac80", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html", "name": "[debian-lts-announce] 20230612 [SECURITY] [DLA 3453-1] vim security update", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://support.apple.com/kb/HT213844", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/kb/HT213845", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20241129-0006/"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:35:22.246Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-2610", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-13T02:16:15.546649Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T17:08:28.935Z"}}], "cna": {"title": "Integer Overflow or Wraparound in vim/vim", "source": {"advisory": "31e67340-935b-4f6c-a923-f7246bc29c7d", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "vim", "product": "vim/vim", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "9.0.1532", "versionType": "custom"}]}], "references": [{"url": "https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d"}, {"url": "https://github.com/vim/vim/commit/ab9a2d884b3a4abe319606ea95a5a6d6b01cd73a"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/", "name": "FEDORA-2023-99d2eaac80", "tags": ["vendor-advisory"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html", "name": "[debian-lts-announce] 20230612 [SECURITY] [DLA 3453-1] vim security update", "tags": ["mailing-list"]}, {"url": "https://support.apple.com/kb/HT213844"}, {"url": "https://support.apple.com/kb/HT213845"}], "descriptions": [{"lang": "en", "value": "Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2023-12-23T07:06:26.300Z"}}}, "cveMetadata": {"cveId": "CVE-2023-2610", "state": "PUBLISHED", "dateUpdated": "2026-06-23T17:19:08.702Z", "dateReserved": "2023-05-09T00:00:00.000Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2023-05-09T00:00:00.000Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "vim/vim", "vendor": "vim", "versions": [{"lessThan": "9.0.1532", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@huntr.dev"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D2C26EC-72A8-44BC-BD3D-B2878B8C3EBA", "versionEndExcluding": "9.0.1532", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532."}], "id": "CVE-2023-2610", "lastModified": "2026-06-17T05:53:00.447", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-05-09T22:15:10.197", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/vim/vim/commit/ab9a2d884b3a4abe319606ea95a5a6d6b01cd73a"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch"], "url": "https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d"}, {"source": "security@huntr.dev", "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html"}, {"source": "security@huntr.dev", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/"}, {"source": "security@huntr.dev", "url": "https://support.apple.com/kb/HT213844"}, {"source": "security@huntr.dev", "url": "https://support.apple.com/kb/HT213845"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/vim/vim/commit/ab9a2d884b3a4abe319606ea95a5a6d6b01cd73a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch"], "url": "https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20241129-0006/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.apple.com/kb/HT213844"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.apple.com/kb/HT213845"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "security@huntr.dev", "type": "Secondary"}]}

{"bugzilla": {"description": "vim: integer overflow vulnerability in vim", "id": "2209048", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2209048"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532."], "mitigation": {"lang": "en:us", "value": "Untrusted vim scripts with -s [scriptin] are not recommended to run."}, "name": "CVE-2023-2610", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "vim", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2023-05-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-2610\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-2610\nhttps://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d"], "statement": "All versions of Vim shipped with Red Hat Enterprise Linux are affected, because of the presence of vulnerable code in our code-base.\nRed Hat Product Security has rated this issue as having a Low security impact, because the \"victim\" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.\nSince Red Hat Enterprise Linux 6, 7 are Out-of-Support-Scope for Low/Moderate flaws, the issue is not currently planned to be addressed in future updates for RHEL-6,7. Only Important and Critical severity flaws will be addressed at this time.\nFor additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle & Updates Policy: https://access.redhat.com/support/policy/updates/errata/.", "threat_severity": "Low"}