CVE-2018-20786: Null Pointer Dereference
Last updated 11 July 2025
Other sources
libvterm through 0+bzr726, as used in Vim and other products, mishandles certain out-of-memory conditions, leading to a denial of service (application crash), related to screen.c, state.c, and vterm.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.0.1378-2+deb12u2Fixed in 2:9.1.1230-2Fixed in 2:9.2.0858-1 - Upgrade
Upgrade
alpine/libvtermto a version that resolves this vulnerability.Fixed in 0.1.20190920-r1 - Upgrade
Upgrade
alpine/libvtermto a version that resolves this vulnerability.Fixed in 0.1.4-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2018-20786?
CVE-2018-20786 has a severity level classified as high due to its potential to cause application crashes.
How do I fix CVE-2018-20786?
To fix CVE-2018-20786, update to libvterm version 0.1.4-2 or later, and for Vim, ensure you are using version 2:8.2.2434-3+deb11u1 or later.
What software is affected by CVE-2018-20786?
CVE-2018-20786 affects libvterm versions up to and including 0+bzr726, and specific versions of Vim that use this library.
What kind of vulnerability is CVE-2018-20786?
CVE-2018-20786 is a denial of service vulnerability that arises from improper handling of out-of-memory conditions.
How can I determine if I am affected by CVE-2018-20786?
You can determine if you're affected by checking if you are using vulnerable versions of libvterm or Vim that are listed in the CVE description.