CVE-2025-24014

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.(CVE-2025-24014)

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

• SECURITY UPDATE: segmentation fault in silent Ex mode due to scrolling function vulnerability
  • debian/patches/CVE-2025-24014.patch: Fix segfault in win_line() by checking that ScreenLines is not NULL in gui_do_scroll()
  • CVE-2025-24014

• CVE-2025-22134: correctly reset the visual mode before opening other windows and buffers
• CVE-2025-24014: skip the redraw attempt that accesses an unallocated variable

Segmentation fault in win_line() in Vim < 9.1.1043. (CVE-2025-24014)

This update for vim fixes the following issues:

Update to version 9.1.1101:

• CVE-2024-43790: possible out-of-bounds read when performing a search command (bsc#1229685).
• CVE-2024-43802: heap buffer overflow due to incorrect flushing of the typeahead buffer (bsc#1229822).
• CVE-2024-45306: heap buffer overflow when cursor position is invalid (bsc#1230078).
• CVE-2025-22134: heap buffer overflow when switching to other buffers using the :all command with active visual mode (bsc#1235695).
• CVE-2025-24014: NULL pointer dereference may lead to segmentation fault when in silent Ex mode (bsc#1236151).
• CVE-2025-1215: memory corruption when manipulating the --log argument (bsc#1237137).

This update for vim fixes the following issues:

Update to version 9.1.1101:

• CVE-2024-43790: possible out-of-bounds read when performing a search command (bsc#1229685).
• CVE-2024-43802: heap buffer overflow due to incorrect flushing of the typeahead buffer (bsc#1229822).
• CVE-2024-45306: heap buffer overflow when cursor position is invalid (bsc#1230078).
• CVE-2025-22134: heap buffer overflow when switching to other buffers using the :all command with active visual mode (bsc#1235695).
• CVE-2025-24014: NULL pointer dereference may lead to segmentation fault when in silent Ex mode (bsc#1236151).
• CVE-2025-1215: memory corruption when manipulating the --log argument (bsc#1237137).

This update for vim fixes the following issues:

Update to version 9.1.1101:

• CVE-2024-43790: possible out-of-bounds read when performing a search command (bsc#1229685).
• CVE-2024-43802: heap buffer overflow due to incorrect flushing of the typeahead buffer (bsc#1229822).
• CVE-2024-45306: heap buffer overflow when cursor position is invalid (bsc#1230078).
• CVE-2025-22134: heap buffer overflow when switching to other buffers using the :all command with active visual mode (bsc#1235695).
• CVE-2025-24014: NULL pointer dereference may lead to segmentation fault when in silent Ex mode (bsc#1236151).
• CVE-2025-1215: memory corruption when manipulating the --log argument (bsc#1237137).

This update for vim fixes the following issues:

vim was updated to 9.1.1101:

• CVE-2024-43374: Fixed use-after-free in alist_add() (bsc#1229238)
• CVE-2024-43790: Fixed Out of bounds read when performing a search command (bsc#1229685)
• CVE-2024-43802: Fixed heap-buffer-overflow in ins_typebuf() (bsc#1229822)
• CVE-2024-45306: Fixed heap-buffer-overflow in Vim (bsc#1230078)
• CVE-2024-47814: Fixed use-after-free when closing buffers in Vim (bsc#1231373)
• CVE-2025-1215: Fixed manipulation of the argument --log leads to memory corruption (bsc#1237137)
• CVE-2025-22134: Fixed heap-buffer-overflow in Vim < 9.1.1003 (bsc#1235695)
• CVE-2025-24014: Fixed segmentation fault in win_line() in Vim < 9.1.1043 (bsc#1236151)

Update to 9.1.1101:

• insexpand.c hard to read
• tests: Test_log_nonexistent only works on Linux
• Update base-syntax, improve variable matching
• Vim9: import with extends may crash
• leaking memory with completing multi lines
• --log with non-existent path causes a crash
• if_perl: Perl 5.38 adds new symbols causing link failure
• tests: matchparen plugin test wrongly named
• Vim9: problem finding implemented method in type hierarchy
• runtime(qf): Update syntax file, match second delimiter
• tests: output of test ...win32_ctrl_z depends on python version
• tests: fix expected return code for python 3.13 on Windows
• tests: timeout might be a bit too small
• tests: test_terminwscroll_topline2 unreliable
• tests: No check when tests are run under Github actions
• tests: plugin tests are named inconsistently
• Vim9: import with extends may crash
• completion doesn't work with multi lines
• filetype: cmmt files are not recognized
• Unable to persistently ignore events in a window and its buffers
• improve syntax highlighting
• setreg() doesn't correctly handle mbyte chars in blockwise mode
• unexpected DCS responses may cause out of bounds reads
• has('bsd') is true for GNU/Hurd
• filetype: Mill files are not recognized
• GUI late startup leads to uninitialized scrollbars
• Add support for lz4 to tar & gzip plugin
• Terminal ansi colors off by one after tgc reset
• included syntax items do not understand contains=TOP
• vim_strnchr() is strange and unnecessary
• Vim9: len variable not used in compile_load()
• runtime(vim): Update base-syntax, match :debuggreedy count prefix
• Strange error when heredoc marker starts with "trim"
• tests: test_compiler fails on Windows without Maven
• 'diffopt' "linematch" cannot be used with {n} less than 10
• args missing after failing to redefine a function
• Cannot control cursor positioning of getchar()
• preinsert text completions not deleted with <C-W>/<C-U>
• getchar() can't distinguish between C-I and Tab
• tests: Test_termwinscroll_topline2 fails on MacOS
• heap-use-after-free and stack-use-after-scope with :14verbose
• no digraph for "Approaches the limit"
• not possible to use plural forms with gettext()
• too many strlen() calls in userfunc.c
• terminal: E315 when dragging the terminal with the mouse
• runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
• runtime(doc): Tweak documentation style a bit
• tests: test_glvs fails when unarchiver not available
• Vim always enables 'termguicolors' in a terminal
• completion: input text deleted with preinsert when adding leader
• translation(sr): Missing Serbian translation for the tutor
• Superfluous cleanup steps in test_ins_complete.vim
• runtime(netrw): correct wrong version check
• Vim doesn't highlight to be inserted text when completing
• runtime(netrw): upstream snapshot of v176
• runtime(dist/vim9): fix regressions in dist#vim9#Open
• runtime(hyprlang): fix string recognition
• make install fails because of a missing dependency
• runtime(asm): add byte directives to syntax script
• Vim doesn't work well with TERM=xterm-direct
• runtime(filetype): commit 99181205c5f8284a3 breaks V…

It was discovered that Vim incorrectly handled certain internal calls when scrolling a window. An attacker could possibly use this issue to cause a denial of service.

USN-7261-1 fixed vulnerabilities in Vim. This update provides the corresponding updates for Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that Vim incorrectly handled certain internal calls when scrolling a window. An attacker could possibly use this issue to cause a denial of service.

It was discovered that Vim incorrectly handled certain internal calls when scrolling a window. An attacker could possibly use this issue to cause a denial of service.