CVE-2021-3872

HIGH

vim is vulnerable to Heap-based Buffer Overflow

Affects 3 products across 3 vendors.

CVSS 3.17.8
EPSS1.5%
Percentile74th
PatchPatched
CVSS Vector — Plain English Requires local access, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-122: Heap-Based Buffer Overflow

Buffer overflow corrupting dynamically allocated heap memory, exploitable for arbitrary code execution.

CWE-787: Out-of-Bounds Write

Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.

Related Attack Patterns (CAPEC)
CAPEC-92 Forced Integer Overflow
via CWE-122

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

vim is vulnerable to a Heap-based Buffer Overflow, which could allow an attacker to execute arbitrary code with the privileges of the user running vim.

BSID: BS-2021-GLOBAL-010763-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-3872?
vim is vulnerable to a Heap-based Buffer Overflow, which could allow an attacker to execute arbitrary code with the privileges of the user running vim.
What is the CVSS score for CVE-2021-3872?
CVE-2021-3872 has CVSS 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 1.5%.
Is CVE-2021-3872 actively exploited?
No confirmed active exploitation of CVE-2021-3872 as of 2026-05-30.
How do I remediate CVE-2021-3872?
Priority: HIGH.
What systems are affected by CVE-2021-3872?
CVE-2021-3872 affects Debian Debian Linux; Fedoraproject Fedora; Vim Vim.
Vulnerability Details
CVE IDCVE-2021-3872
BSIDBS-2021-GLOBAL-010763-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2021-10-19
Last Modified2025-11-03
ICS Relevance15%
Weakness (CWE)
Heap-Based Buffer OverflowOut-of-Bounds Write
SourceNVD
Official Description

vim is vulnerable to Heap-based Buffer Overflow

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by crafting a specially crafted file that, when opened with vim, triggers the buffer overflow. This can lead to arbitrary code execution.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Debian Debian Linux 9.0
Fedoraproject Fedora 33 35
Vim Vim < 8.2.3487
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1822 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashf0ce4164223452c5ae8bc454008c82937ea70a5fed24d56b307df1935b22edaa7ee28b5fba74893b1450c88666caf39c5c2771bbd08343a12137e79b22434470
Related CVEs affecting Debian
CVE-2012-0444 10.0 Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 ... CVE-2013-2863 10.0 Google Chrome before 27.0.1453.110 does not properly handle SSL sockets, whic... CVE-2015-2724 10.0 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox... CVE-2017-16845 10.0 hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during gue... CVE-1999-0698 10.0 Denial of service in IP protocol logger (ippl) on Red Hat and Debian Linux.
View all Debian CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →