CVE-2025-1215

A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.(CVE-2025-1215)

Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the :redir ex command to register, variables and files. It also allows to show the contents of registers using the :registers or :display ex command. When redirecting the output of :display to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the :display command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the + and * registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers * or +. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2025-26603)

A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.

This update for vim fixes the following issues:

Update to version 9.1.1101:

• CVE-2024-43790: possible out-of-bounds read when performing a search command (bsc#1229685).
• CVE-2024-43802: heap buffer overflow due to incorrect flushing of the typeahead buffer (bsc#1229822).
• CVE-2024-45306: heap buffer overflow when cursor position is invalid (bsc#1230078).
• CVE-2025-22134: heap buffer overflow when switching to other buffers using the :all command with active visual mode (bsc#1235695).
• CVE-2025-24014: NULL pointer dereference may lead to segmentation fault when in silent Ex mode (bsc#1236151).
• CVE-2025-1215: memory corruption when manipulating the --log argument (bsc#1237137).

This update for vim fixes the following issues:

Update to version 9.1.1101:

• CVE-2024-43790: possible out-of-bounds read when performing a search command (bsc#1229685).
• CVE-2024-43802: heap buffer overflow due to incorrect flushing of the typeahead buffer (bsc#1229822).
• CVE-2024-45306: heap buffer overflow when cursor position is invalid (bsc#1230078).
• CVE-2025-22134: heap buffer overflow when switching to other buffers using the :all command with active visual mode (bsc#1235695).
• CVE-2025-24014: NULL pointer dereference may lead to segmentation fault when in silent Ex mode (bsc#1236151).
• CVE-2025-1215: memory corruption when manipulating the --log argument (bsc#1237137).

This update for vim fixes the following issues:

Update to version 9.1.1101:

• CVE-2024-43790: possible out-of-bounds read when performing a search command (bsc#1229685).
• CVE-2024-43802: heap buffer overflow due to incorrect flushing of the typeahead buffer (bsc#1229822).
• CVE-2024-45306: heap buffer overflow when cursor position is invalid (bsc#1230078).
• CVE-2025-22134: heap buffer overflow when switching to other buffers using the :all command with active visual mode (bsc#1235695).
• CVE-2025-24014: NULL pointer dereference may lead to segmentation fault when in silent Ex mode (bsc#1236151).
• CVE-2025-1215: memory corruption when manipulating the --log argument (bsc#1237137).

This update for vim fixes the following issues:

vim was updated to 9.1.1101:

• CVE-2024-43374: Fixed use-after-free in alist_add() (bsc#1229238)
• CVE-2024-43790: Fixed Out of bounds read when performing a search command (bsc#1229685)
• CVE-2024-43802: Fixed heap-buffer-overflow in ins_typebuf() (bsc#1229822)
• CVE-2024-45306: Fixed heap-buffer-overflow in Vim (bsc#1230078)
• CVE-2024-47814: Fixed use-after-free when closing buffers in Vim (bsc#1231373)
• CVE-2025-1215: Fixed manipulation of the argument --log leads to memory corruption (bsc#1237137)
• CVE-2025-22134: Fixed heap-buffer-overflow in Vim < 9.1.1003 (bsc#1235695)
• CVE-2025-24014: Fixed segmentation fault in win_line() in Vim < 9.1.1043 (bsc#1236151)

Update to 9.1.1101:

• insexpand.c hard to read
• tests: Test_log_nonexistent only works on Linux
• Update base-syntax, improve variable matching
• Vim9: import with extends may crash
• leaking memory with completing multi lines
• --log with non-existent path causes a crash
• if_perl: Perl 5.38 adds new symbols causing link failure
• tests: matchparen plugin test wrongly named
• Vim9: problem finding implemented method in type hierarchy
• runtime(qf): Update syntax file, match second delimiter
• tests: output of test ...win32_ctrl_z depends on python version
• tests: fix expected return code for python 3.13 on Windows
• tests: timeout might be a bit too small
• tests: test_terminwscroll_topline2 unreliable
• tests: No check when tests are run under Github actions
• tests: plugin tests are named inconsistently
• Vim9: import with extends may crash
• completion doesn't work with multi lines
• filetype: cmmt files are not recognized
• Unable to persistently ignore events in a window and its buffers
• improve syntax highlighting
• setreg() doesn't correctly handle mbyte chars in blockwise mode
• unexpected DCS responses may cause out of bounds reads
• has('bsd') is true for GNU/Hurd
• filetype: Mill files are not recognized
• GUI late startup leads to uninitialized scrollbars
• Add support for lz4 to tar & gzip plugin
• Terminal ansi colors off by one after tgc reset
• included syntax items do not understand contains=TOP
• vim_strnchr() is strange and unnecessary
• Vim9: len variable not used in compile_load()
• runtime(vim): Update base-syntax, match :debuggreedy count prefix
• Strange error when heredoc marker starts with "trim"
• tests: test_compiler fails on Windows without Maven
• 'diffopt' "linematch" cannot be used with {n} less than 10
• args missing after failing to redefine a function
• Cannot control cursor positioning of getchar()
• preinsert text completions not deleted with <C-W>/<C-U>
• getchar() can't distinguish between C-I and Tab
• tests: Test_termwinscroll_topline2 fails on MacOS
• heap-use-after-free and stack-use-after-scope with :14verbose
• no digraph for "Approaches the limit"
• not possible to use plural forms with gettext()
• too many strlen() calls in userfunc.c
• terminal: E315 when dragging the terminal with the mouse
• runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
• runtime(doc): Tweak documentation style a bit
• tests: test_glvs fails when unarchiver not available
• Vim always enables 'termguicolors' in a terminal
• completion: input text deleted with preinsert when adding leader
• translation(sr): Missing Serbian translation for the tutor
• Superfluous cleanup steps in test_ins_complete.vim
• runtime(netrw): correct wrong version check
• Vim doesn't highlight to be inserted text when completing
• runtime(netrw): upstream snapshot of v176
• runtime(dist/vim9): fix regressions in dist#vim9#Open
• runtime(hyprlang): fix string recognition
• make install fails because of a missing dependency
• runtime(asm): add byte directives to syntax script
• Vim doesn't work well with TERM=xterm-direct
• runtime(filetype): commit 99181205c5f8284a3 breaks V…

It was discovered that Vim incorrectly handled memory when using invalid input with the log option. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-1215)

It was discovered that Vim incorrectly handled memory when redirecting certain output to the register. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-26603)