CVE-2021-3903

HIGH

vim < 8.2.3564 - Heap-based Buffer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-3903. PoCs published by cemonatk.

AI-analyzed exploit summary This repository contains a detailed technical analysis of CVE-2021-3903, a heap-based buffer overflow vulnerability in Vim. It includes a stack trace from AddressSanitizer, references to patches, and a description of the vulnerability's impact.

Description

vim is vulnerable to Heap-based Buffer Overflow

Exploits (1)

github WRITEUP 3 stars
by cemonatk · poc
https://github.com/cemonatk/onefuzzyway/tree/main/CVEs/vim/CVE-2021-3903.md

This repository contains a detailed technical analysis of CVE-2021-3903, a heap-based buffer overflow vulnerability in Vim. It includes a stack trace from AddressSanitizer, references to patches, and a description of the vulnerability's impact.

Classification
Writeup 90%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: Vim (master branch, commit 3c5904d)
No auth needed
Prerequisites: Vim compiled with AddressSanitizer · Proof-of-Concept (PoC) file
devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (7)

Core 7
Core References
Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://huntr.dev/bounties/35738a4f-55ce-446c-b836-2fb0b39625f8
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2022/01/15/1
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html

Scores

CVSS v3 7.8
EPSS 0.0060
EPSS Percentile 43.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-122 CWE-787
Status published
Products (5)
debian/debian_linux 9.0
fedoraproject/fedora 33
fedoraproject/fedora 34
fedoraproject/fedora 35
vim/vim < 8.2.3564
Published Oct 27, 2021
Tracked Since Feb 18, 2026