What is CVE-2017-17087?

CVE-2017-17087 is a medium-severity vulnerability in Vim, classified under Exposure of Resource to Wrong Sphere. CVSS score: 5.5/10. Published 2017-12-01.

How severe is CVE-2017-17087?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Is CVE-2017-17087 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Vim

CVE-2017-17087

fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.

Published 2017-12-01 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.004 (26.7th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 26.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Vim
Canonical Ubuntu Linux — versions 16.04, 18.04
Debian Linux — versions 8.0, 9.0

Weakness classification (CWE)

CWE-668 — Exposure of Resource to Wrong Sphere

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

groups.google.com/d/msg/vim_dev/sRT9BtjLWMk/BRtSXNU4BwAJ (Mailing List, Third Party Advisory, Issue Tracking)
openwall.com/lists/oss-security/2017/11/27/2 (Mailing List)
security.cucumberlinux.com/security/details.php (Third Party Advisory, Issue Tracking)
github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8 (Patch, Third Party Advisory)
lists.debian.org/debian-lts-announce/2019/08/msg00003.html (mailing-list, Mailing List, Third Party Advisory)
usn.ubuntu.com/4582-1/ (vendor-advisory, Third Party Advisory)
lists.debian.org/debian-lts-announce/2022/01/msg00003.html (mailing-list, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2017-17087?: CVE-2017-17087 is a medium-severity vulnerability in Vim, classified under Exposure of Resource to Wrong Sphere. CVSS score: 5.5/10. Published 2017-12-01.
How severe is CVE-2017-17087?: Medium severity. CVSS v3 base score is 5.5 out of 10.
Is CVE-2017-17087 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.