Skip to content
OpenAdvisories
Medium · 4.2 CVE-2025-22134 EUVD-2025-2654

heap-buffer-overflow with visual mode in Vim < 9.1.1003

Published Jan 13, 2025 · Updated Mar 14, 2025 · Assigned by GitHub_M

Description

When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003

Affected products

VendorProductAffectedFixed
vim vim < v9.1.1003 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 vim 2:9.1.1113-1 —
Debian 13 vim 2:9.1.1113-1 —
Debian 12 vim No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS vim 2:9.1.0016-1ubuntu7.6 USN-7220-1
Ubuntu 22.04 LTS vim 2:8.2.3995-1ubuntu2.22 USN-7220-1
Ubuntu 20.04 LTS vim 2:8.1.2269-1ubuntu5.30 USN-7220-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS vim No fix yet —
Ubuntu Pro 16.04 LTS vim No fix yet —
Ubuntu Pro 14.04 LTS vim No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP6 vim 9.1.1101-150500.20.21.1 SUSE-SU-2025:0723-1
SLES 12 SP5 vim 9.1.1101-17.41.1 SUSE-SU-2025:0722-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.0 vim 9.1.1101-1.1 SUSE-SU-2025:20128-1
SLE Micro 5.5 vim 9.1.1101-150500.20.21.1 SUSE-SU-2025:0723-1
SLE Micro 5.4 vim 9.1.1101-150000.5.69.1 SUSE-SU-2025:0724-1
SLE Micro 5.3 vim 9.1.1101-150000.5.69.1 SUSE-SU-2025:0724-1
SLE Micro 5.2 vim 9.1.1101-150000.5.69.1 SUSE-SU-2025:0724-1
SLE Micro 5.1 vim 9.1.1101-150000.5.69.1 SUSE-SU-2025:0724-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 vim 9.1.1101-150500.20.21.1 SUSE-SU-2025:0723-1
ReleasePackageFixed inAdvisory
Alpine v3.24 vim 9.1.1003-r0 —
Alpine v3.23 vim 9.1.1003-r0 —
Alpine v3.22 vim 9.1.1003-r0 —
Alpine v3.21 vim 9.1.1003-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 xxd +6 2:9.2.240-1.amzn2023.0.2 ALAS2023-2026-1584

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 vim 9.1.0791-2 —
Azure Linux 2 (CBL-Mariner) vim 9.1.0791-3 —

Advisories 8

References