Description
A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | vim | 9.1.1096 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 2:9.1.1113-1 | — |
| Debian 13 | vim | 2:9.1.1113-1 | — |
| Debian 12 | vim | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | vim | 2:9.1.0016-1ubuntu7.8 | USN-7419-1 |
| Ubuntu 22.04 LTS | vim | 2:8.2.3995-1ubuntu2.24 | USN-7419-1 |
| Ubuntu 20.04 LTS | vim | 2:8.1.2269-1ubuntu5.32 | USN-7419-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | vim | 2:8.0.1453-1ubuntu1.13+esm12 | USN-7419-1 |
| Ubuntu Pro 16.04 LTS | vim | 2:7.4.1689-3ubuntu1.5+esm27 | USN-7419-1 |
| Ubuntu Pro 14.04 LTS | vim | 2:7.4.052-1ubuntu3.1+esm21 | USN-7419-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | vim | 9.1.1101-150500.20.21.1 | SUSE-SU-2025:0723-1 |
| SLES 12 SP5 | vim | 9.1.1101-17.41.1 | SUSE-SU-2025:0722-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | vim | 9.1.1101-1.1 | SUSE-SU-2025:20128-1 |
| SLE Micro 5.5 | vim | 9.1.1101-150500.20.21.1 | SUSE-SU-2025:0723-1 |
| SLE Micro 5.4 | vim | 9.1.1101-150000.5.69.1 | SUSE-SU-2025:0724-1 |
| SLE Micro 5.3 | vim | 9.1.1101-150000.5.69.1 | SUSE-SU-2025:0724-1 |
| SLE Micro 5.2 | vim | 9.1.1101-150000.5.69.1 | SUSE-SU-2025:0724-1 |
| SLE Micro 5.1 | vim | 9.1.1101-150000.5.69.1 | SUSE-SU-2025:0724-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | vim | 9.1.1101-150500.20.21.1 | SUSE-SU-2025:0723-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | xxd +6 | 2:9.1.1202-1.amzn2023.0.1 | ALAS2023-2025-932 |
| Amazon Linux 2 | xxd +6 | 2:9.0.2153-1.amzn2.0.4 | ALAS2-2025-2827 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | vim | 9.1.0791-4 | — |
| Azure Linux 2 (CBL-Mariner) | vim | 9.1.0791-4 | — |
Advisories 9
- WID-SEC-2025-1439 Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 11, 2026
- USN-7419-1 vim vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- SUSE-SU-2025:20128-1 Security update for vim SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-0360 vim: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Feb 15, 2026
- SUSE-SU-2025:0722-1 Security update for vim SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0724-1 Security update for vim SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0723-1 Security update for vim SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2025-2827 Moderate: vim security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 16, 2025
- ALAS2023-2025-932 Moderate: vim security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 14, 2025
References
- VDB-295174 | vim main.c memory corruption vdb-entry technical-description
- VDB-295174 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #497546 | VIM vim 68d08588928b29fe0b19e3513cd689486260ab1c illegal read access third-party-advisory
- https://github.com/vim/vim/issues/16606 issue-tracking
- https://github.com/vim/vim/commit/c5654b84480822817bb7b69ebc97c174c91185e9 patch
- https://github.com/vim/vim/releases/tag/v9.1.1097 patch