Description
A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, "when coloring is turned on".
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | vim | 9.1.0000 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | xxd +6 | 2:9.2.240-1.amzn2023.0.2 | ALAS2023-2026-1584 |
Advisories 2
- ALAS2023-2026-1584 Important: vim security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 13, 2026
- WID-SEC-2025-1897 vim: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Aug 25, 2025
References
- VDB-321222 | vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption vdb-entry technical-description
- VDB-321222 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #630898 | vim xxd vim-9.1.0000 and related xxd versions (latest master branch) Memory Corruption third-party-advisory
- https://github.com/vim/vim/issues/17940 issue-tracking
- https://github.com/vim/vim/issues/17940#issuecomment-3203415781 issue-tracking
- https://drive.google.com/file/d/1iFbTpW79vqBPkFjWYzGYIh_E6esPhYVY/view?usp=sharing exploit