Description
When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vim | vim | < v9.1.1003 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 2:9.1.1113-1 | — |
| Debian 13 | vim | 2:9.1.1113-1 | — |
| Debian 12 | vim | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | vim | 2:9.1.0016-1ubuntu7.6 | USN-7220-1 |
| Ubuntu 22.04 LTS | vim | 2:8.2.3995-1ubuntu2.22 | USN-7220-1 |
| Ubuntu 20.04 LTS | vim | 2:8.1.2269-1ubuntu5.30 | USN-7220-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | vim | No fix yet | — |
| Ubuntu Pro 16.04 LTS | vim | No fix yet | — |
| Ubuntu Pro 14.04 LTS | vim | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | vim | 9.1.1101-150500.20.21.1 | SUSE-SU-2025:0723-1 |
| SLES 12 SP5 | vim | 9.1.1101-17.41.1 | SUSE-SU-2025:0722-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | vim | 9.1.1101-1.1 | SUSE-SU-2025:20128-1 |
| SLE Micro 5.5 | vim | 9.1.1101-150500.20.21.1 | SUSE-SU-2025:0723-1 |
| SLE Micro 5.4 | vim | 9.1.1101-150000.5.69.1 | SUSE-SU-2025:0724-1 |
| SLE Micro 5.3 | vim | 9.1.1101-150000.5.69.1 | SUSE-SU-2025:0724-1 |
| SLE Micro 5.2 | vim | 9.1.1101-150000.5.69.1 | SUSE-SU-2025:0724-1 |
| SLE Micro 5.1 | vim | 9.1.1101-150000.5.69.1 | SUSE-SU-2025:0724-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | vim | 9.1.1101-150500.20.21.1 | SUSE-SU-2025:0723-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | vim | 9.1.1003-r0 | — |
| Alpine v3.23 | vim | 9.1.1003-r0 | — |
| Alpine v3.22 | vim | 9.1.1003-r0 | — |
| Alpine v3.21 | vim | 9.1.1003-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | xxd +6 | 2:9.2.240-1.amzn2023.0.2 | ALAS2023-2026-1584 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | vim | 9.1.0791-2 | — |
| Azure Linux 2 (CBL-Mariner) | vim | 9.1.0791-3 | — |
Advisories 8
- WID-SEC-2025-1439 Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 11, 2026
- ALAS2023-2026-1584 Important: vim security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 13, 2026
- SUSE-SU-2025:20128-1 Security update for vim SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-0049 vim: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Feb 15, 2026
- USN-7220-1 vim vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2025:0722-1 Security update for vim SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0724-1 Security update for vim SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0723-1 Security update for vim SUSE / openSUSE Security Updates · Feb 4, 2026