Description
A security flaw has been discovered in vim up to 9.1.1615. Affected by this vulnerability is the function main of the file src/xxd/xxd.c of the component xxd. The manipulation results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be exploited. Upgrading to version 9.1.1616 addresses this issue. The patch is identified as eeef7c77436a78cd27047b0f5fa6925d56de3cb0. It is recommended to upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | vim | 9.1.1615 | 9.1.1616 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 2:9.1.1829-1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | xxd +6 | 2:9.2.240-1.amzn2023.0.2 | ALAS2023-2026-1584 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | vim | 9.1.1616-1 | — |
| Azure Linux 2 (CBL-Mariner) | vim | 9.1.1616-1 | — |
Advisories 2
- ALAS2023-2026-1584 Important: vim security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 13, 2026
- WID-SEC-2025-1897 vim: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Aug 25, 2025
References
- VDB-321223 | vim xxd xxd.c main buffer overflow vdb-entry technical-description
- VDB-321223 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #630903 | vim xxd vim-9.1.0000 and related xxd versions (latest master branch) Buffer Overflow third-party-advisory
- https://github.com/vim/vim/issues/17944 issue-tracking
- https://github.com/vim/vim/pull/17947 issue-tracking
- https://drive.google.com/file/d/1JLnqrdcGsjUhbYzIEweXIGZyETjHlKtX/view?usp=sharing exploit
- https://github.com/vim/vim/commit/eeef7c77436a78cd27047b0f5fa6925d56de3cb0 patch
- https://github.com/vim/vim/releases/tag/v9.1.1616 patch