Security readout for executives and security teams
Plain-English summary
CVE-2023-46246 affects Vim versions up to 9.0.2067. A malformed argument to Vim’s :history command can trigger an integer overflow and possible use-after-free, causing low availability impact. This is mainly a local software-risk issue, not a known remotely exploitable business emergency.
Executive priority
Handle through normal patch management, with faster action for multi-user Linux/Unix systems and managed images. No source provided indicates active exploitation, but Vim is widely deployed and easy to overlook in base images.
Technical view
The flaw is in Vim command history handling. Memory grown in ga_grow_inner can be freed through do_cmdline and later reused in cmdhist.c when :history argument handling overflows accepted values. Sources list CWE-190 and CWE-416. Vim patched the issue in 9.0.2068.
Likely exposure
Systems with Vim <= 9.0.2067 are potentially exposed, including distributions or appliances that bundle Vim. Exposure is most relevant where local users or automated workflows can invoke Vim with crafted command input.
Exploitation context
The CVSS vector is local, low complexity, no privileges, no user interaction, with low availability impact. The source bundle does not show CISA KEV listing or other evidence of active exploitation. No confidentiality or integrity impact is reported.
Researcher notes
The advisory describes integer overflow leading to possible heap-use-after-free in :history handling. Public sources identify the fixing commit and version, but the supplied evidence does not establish practical exploitability beyond low availability impact.
Mitigation direction
- Upgrade Vim to version 9.0.2068 or later where available.
- Apply operating system vendor updates for Vim packages.
- Check appliance/vendor advisories if Vim is embedded or redistributed.
- Prioritize shared systems where untrusted local users can run Vim.
Validation and detection
- Inventory installed Vim versions across servers, workstations, containers, and appliances.
- Confirm whether versions are <= 9.0.2067.
- Verify package manager advisories include the CVE fix.
- Review vendor advisories for bundled Vim status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-46246 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L2.51.4GitHub_MVulnerability scoring details
Base CVSS 3.1 score
4MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/vim/vim/security/advisories/GHSA-q22m-h7m2-9mgmCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918541e0de2a32f0f45aCVE reference, GitHub_M · x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20231208-0006/CVE reference, GitHub_M
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNMFS3IH74KEMMESOA3EOB6MZ56TWGFF/CVE reference, GitHub_M
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVA7K73WHQH4KVFDJQ7ELIUD2WK5ZT5E/CVE reference, GitHub_M
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.