CVE-2017-5953: Integer Overflow
Last updated 25 August 2025
Other sources
vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/neovimto a version that resolves this vulnerability.Fixed in 0.4.4-1Fixed in 0.7.2-7Fixed in 0.10.4-8Fixed in 0.12.3-4Fixed in 0.12.4-1 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:8.2.2434-3+deb11u1Fixed in 2:8.2.2434-3+deb11u3Fixed in 2:9.0.1378-2+deb12u2Fixed in 2:9.1.1230-2Fixed in 2:9.2.0524-1Fixed in 2:9.2.0782-1 - Upgrade
Upgrade
vimto a version that resolves this vulnerability.Fixed in 8.0.0322 - Operational
Update Vim to patch 8.0.0322 because versions before 8.0.0322 may cause an integer overflow during memory allocation when handling a spell file, which can lead to a buffer overflow.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5953?
CVE-2017-5953 is classified as a high-severity vulnerability due to its potential for causing buffer overflows.
How do I fix CVE-2017-5953?
To fix CVE-2017-5953, upgrade your Vim installation to version 8.0.0322 or later.
Which versions are affected by CVE-2017-5953?
CVE-2017-5953 affects Vim versions prior to 8.0.0322 and specific Debian packages of Neovim and Vim.
What impact does CVE-2017-5953 have on vulnerable systems?
CVE-2017-5953 can lead to integer overflows and buffer overflows, potentially allowing an attacker to execute arbitrary code.
Is CVE-2017-5953 actively exploited?
As of the latest information, there are no confirmed active exploits specifically targeting CVE-2017-5953.