From 1330de8653523840f55e62f2dffcd77440e6476c Mon Sep 17 00:00:00 2001
From: Konstantin Sykulev <konst@sykulev.com>
Date: Wed, 21 Jan 2026 10:33:14 -0800
Subject: [PATCH] created mac vim mapping software transformer (#38333)

**Related issue:** Resolves #33005

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
---
 changes/33005-macvim                   |  1 +
 server/vulnerabilities/nvd/cpe.go      | 38 ++++++++++++++
 server/vulnerabilities/nvd/cpe_test.go | 73 ++++++++++++++++++++++++++
 3 files changed, 112 insertions(+)
 create mode 100644 changes/33005-macvim

diff --git a/changes/33005-macvim b/changes/33005-macvim
new file mode 100644
index 0000000000..329fe5a902
--- /dev/null
+++ b/changes/33005-macvim
@@ -0,0 +1 @@
+* Fixed false positive for CVE-2023-41036 for macvim
\ No newline at end of file
diff --git a/server/vulnerabilities/nvd/cpe.go b/server/vulnerabilities/nvd/cpe.go
index 7de65280b7..0dc1b71018 100644
--- a/server/vulnerabilities/nvd/cpe.go
+++ b/server/vulnerabilities/nvd/cpe.go
@@ -395,6 +395,44 @@ var (
 				s.Version = newVersion
 			},
 		},
+		{
+			// MacVim uses dual versioning: MacVim release numbers (r178, r179, etc.) and bundled Vim versions (9.0.1897, 9.1.0, etc.)
+			// NVD CVEs reference MacVim release numbers, but Fleet inventories the bundled Vim version from macOS metadata.
+			// See https://github.com/macvim-dev/macvim/releases for version mappings.
+			matches: func(s *fleet.Software) bool {
+				return s.Name == "MacVim" && s.BundleIdentifier == "org.vim.MacVim" && s.Source == "apps"
+			},
+			mutate: func(s *fleet.Software, logger log.Logger) {
+				vimToMacVimMap := map[string]string{
+					// r182 series
+					"9.1.2068": "182.1", // r182.1 (prerelease)
+					"9.1.1887": "182",   // r182 (stable)
+					// r181 series
+					"9.1.1577": "181.2", // r181.2 (prerelease)
+					"9.1.1251": "181.1", // r181.1 (prerelease)
+					"9.1.1128": "181",   // r181 (stable)
+					// r180 series
+					"9.1.1050": "180.2", // r180.2 (prerelease)
+					"9.1.1000": "180.1", // r180.1 (prerelease)
+					"9.1.0727": "180",   // r180 (stable)
+					// r179 series
+					"9.1.0695": "179.1", // r179.1 (prerelease)
+					"9.1.0":    "179",   // r179 (stable)
+					// r178 series
+					"9.0.1897": "178", // r178 (stable)
+				}
+
+				if macVimRelease, ok := vimToMacVimMap[s.Version]; ok {
+					level.Debug(logger).Log("msg", "converting MacVim Vim version to release number",
+						"original_version", s.Version, "macvim_release", macVimRelease)
+					s.Version = macVimRelease
+				} else {
+					// For unknown versions, leave as-is to avoid false negatives
+					level.Debug(logger).Log("msg", "unknown MacVim Vim version, unable to convert to release number",
+						"version", s.Version)
+				}
+			},
+		},
 		{
 			// Homebrew's "imp" (Integrative Modeling Platform) is incorrectly matched against
 			// Horde IMP CPEs. Rename the Homebrew package to prevent incorrect CPE
diff --git a/server/vulnerabilities/nvd/cpe_test.go b/server/vulnerabilities/nvd/cpe_test.go
index 5d5a284e69..911df1afb2 100644
--- a/server/vulnerabilities/nvd/cpe_test.go
+++ b/server/vulnerabilities/nvd/cpe_test.go
@@ -2316,6 +2316,79 @@ func TestMutateSoftware(t *testing.T) {
 				Source:  "programs",
 			},
 		},
+		{
+			name: "MacVim with known Vim version (9.0.1897 -> 178)",
+			s: &fleet.Software{
+				Name:             "MacVim",
+				Version:          "9.0.1897",
+				Source:           "apps",
+				BundleIdentifier: "org.vim.MacVim",
+			},
+			sanitized: &fleet.Software{
+				Name:             "MacVim",
+				Version:          "178",
+				Source:           "apps",
+				BundleIdentifier: "org.vim.MacVim",
+			},
+		},
+		{
+			name: "MacVim with known Vim version (9.1.0 -> 179)",
+			s: &fleet.Software{
+				Name:             "MacVim",
+				Version:          "9.1.0",
+				Source:           "apps",
+				BundleIdentifier: "org.vim.MacVim",
+			},
+			sanitized: &fleet.Software{
+				Name:             "MacVim",
+				Version:          "179",
+				Source:           "apps",
+				BundleIdentifier: "org.vim.MacVim",
+			},
+		},
+		{
+			name: "MacVim with prerelease Vim version (9.1.1577 -> 181.2)",
+			s: &fleet.Software{
+				Name:             "MacVim",
+				Version:          "9.1.1577",
+				Source:           "apps",
+				BundleIdentifier: "org.vim.MacVim",
+			},
+			sanitized: &fleet.Software{
+				Name:             "MacVim",
+				Version:          "181.2",
+				Source:           "apps",
+				BundleIdentifier: "org.vim.MacVim",
+			},
+		},
+		{
+			name: "MacVim with unknown Vim version (leaves as-is)",
+			s: &fleet.Software{
+				Name:             "MacVim",
+				Version:          "9.2.9999",
+				Source:           "apps",
+				BundleIdentifier: "org.vim.MacVim",
+			},
+			sanitized: &fleet.Software{
+				Name:             "MacVim",
+				Version:          "9.2.9999",
+				Source:           "apps",
+				BundleIdentifier: "org.vim.MacVim",
+			},
+		},
+		{
+			name: "MacVim from wrong source (not transformed)",
+			s: &fleet.Software{
+				Name:    "MacVim",
+				Version: "9.0.1897",
+				Source:  "programs",
+			},
+			sanitized: &fleet.Software{
+				Name:    "MacVim",
+				Version: "9.0.1897",
+				Source:  "programs",
+			},
+		},
 		{
 			name: "Homebrew imp (Integrative Modeling Platform)",
 			s: &fleet.Software{