{"id":"CVE-2025-26603","aliases":["ALPINE-CVE-2025-26603","AZL-56913","AZL-56962","BELL-CVE-2025-26603","CLSA-2025-1756928197","CLSA-2026-1778259521","CLSA-2026-1779214181","DEBIAN-CVE-2025-26603","EUVD-2025-5099","GHSA-63p5-mwg2-787v","MGASA-2025-0074","OESA-2025-1231","UBUNTU-CVE-2025-26603","USN-7419-1"],"status":"published","title":"heap-use-after-free in function str_to_reg in vim/vim","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00239,"percentile":0.15162,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2025-02-18T19:04:24Z","modified":"2026-11-03T06:33:00Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"vim","fixed_in":["9.1.1164-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"vim","fixed_in":["9.1.1164-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vim","fixed_in":["9.1.1164-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"vim","fixed_in":["9.1.0791-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"vim","fixed_in":["9.1.0791-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"vim","fixed_in":["9.1.1164-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"vim","fixed_in":["9.1.1164-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-common","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-doc","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gui-common","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-runtime","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-tiny","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els54"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vim","fixed_in":["2:9.1.1230-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vim","fixed_in":["2:9.1.1230-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"vim","fixed_in":["9.1.1122-1.mga9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","fixed_in":["2:7.4.052-1ubuntu3.1+esm21"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","fixed_in":["2:7.4.1689-3ubuntu1.5+esm27"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","fixed_in":["2:8.0.1453-1ubuntu1.13+esm12"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"vim","fixed_in":["2:8.1.2269-1ubuntu5.32"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"vim","fixed_in":["2:8.2.3995-1ubuntu2.24"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"vim","fixed_in":["2:9.1.0016-1ubuntu7.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1164-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1164-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1164-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0791-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0791-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0820-r2"},{"fixed":"9.1.1164-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1395-r0"},{"fixed":"9.1.1164-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gui-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els54"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els25"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els25"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els25"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els25"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els25"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els25"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els25"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els25"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els25"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els25"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:9.0.1378-2","2:9.0.1378-2+deb12u1","2:9.0.1378-2+deb12u2","2:9.0.1658-1","2:9.0.1672-1","2:9.0.1894-1","2:9.0.2018-1","2:9.0.2087-1","2:9.0.2103-1","2:9.0.2116-1","2:9.0.2189-1","2:9.1.0-1","2:9.1.0016-1","2:9.1.0199-1","2:9.1.0374-1","2:9.1.0377-1","2:9.1.0496-1","2:9.1.0698-1","2:9.1.0709-1","2:9.1.0709-2","2:9.1.0777-1","2:9.1.0861-1","2:9.1.0967-1","2:9.1.0967-2","2:9.1.1113-1","2:9.1.1230-1","2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1","2:9.2.0338-1","2:9.2.0355-1","2:9.2.0428-1","2:9.2.0461-1","2:9.2.0524-1","2:9.2.0782-1","2:9.2.0858-1"]},{"source":"osv","ecosystem":"Debian:13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.1230-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.1230-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1122-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-17.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-17.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-32.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-32.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-32.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm21"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3","2:7.4.052-1ubuntu3.1+esm4","2:7.4.052-1ubuntu3.1+esm5","2:7.4.052-1ubuntu3.1+esm6","2:7.4.052-1ubuntu3.1+esm7","2:7.4.052-1ubuntu3.1+esm8","2:7.4.052-1ubuntu3.1+esm9","2:7.4.052-1ubuntu3.1+esm10","2:7.4.052-1ubuntu3.1+esm11","2:7.4.052-1ubuntu3.1+esm12","2:7.4.052-1ubuntu3.1+esm13","2:7.4.052-1ubuntu3.1+esm14","2:7.4.052-1ubuntu3.1+esm15","2:7.4.052-1ubuntu3.1+esm16","2:7.4.052-1ubuntu3.1+esm17","2:7.4.052-1ubuntu3.1+esm18","2:7.4.052-1ubuntu3.1+esm19","2:7.4.052-1ubuntu3.1+esm20"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm27"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2","2:7.4.1689-3ubuntu1.5+esm3","2:7.4.1689-3ubuntu1.5+esm4","2:7.4.1689-3ubuntu1.5+esm5","2:7.4.1689-3ubuntu1.5+esm6","2:7.4.1689-3ubuntu1.5+esm7","2:7.4.1689-3ubuntu1.5+esm8","2:7.4.1689-3ubuntu1.5+esm10","2:7.4.1689-3ubuntu1.5+esm11","2:7.4.1689-3ubuntu1.5+esm12","2:7.4.1689-3ubuntu1.5+esm13","2:7.4.1689-3ubuntu1.5+esm14","2:7.4.1689-3ubuntu1.5+esm15","2:7.4.1689-3ubuntu1.5+esm17","2:7.4.1689-3ubuntu1.5+esm18","2:7.4.1689-3ubuntu1.5+esm19","2:7.4.1689-3ubuntu1.5+esm20","2:7.4.1689-3ubuntu1.5+esm22","2:7.4.1689-3ubuntu1.5+esm23","2:7.4.1689-3ubuntu1.5+esm24","2:7.4.1689-3ubuntu1.5+esm25","2:7.4.1689-3ubuntu1.5+esm26"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm12"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9","2:8.0.1453-1ubuntu1.10","2:8.0.1453-1ubuntu1.11","2:8.0.1453-1ubuntu1.12","2:8.0.1453-1ubuntu1.13","2:8.0.1453-1ubuntu1.13+esm1","2:8.0.1453-1ubuntu1.13+esm3","2:8.0.1453-1ubuntu1.13+esm4","2:8.0.1453-1ubuntu1.13+esm5","2:8.0.1453-1ubuntu1.13+esm6","2:8.0.1453-1ubuntu1.13+esm7","2:8.0.1453-1ubuntu1.13+esm8","2:8.0.1453-1ubuntu1.13+esm9","2:8.0.1453-1ubuntu1.13+esm10","2:8.0.1453-1ubuntu1.13+esm11"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.32"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9","2:8.1.2269-1ubuntu5.11","2:8.1.2269-1ubuntu5.12","2:8.1.2269-1ubuntu5.13","2:8.1.2269-1ubuntu5.14","2:8.1.2269-1ubuntu5.15","2:8.1.2269-1ubuntu5.16","2:8.1.2269-1ubuntu5.17","2:8.1.2269-1ubuntu5.18","2:8.1.2269-1ubuntu5.20","2:8.1.2269-1ubuntu5.21","2:8.1.2269-1ubuntu5.22","2:8.1.2269-1ubuntu5.23","2:8.1.2269-1ubuntu5.24","2:8.1.2269-1ubuntu5.25","2:8.1.2269-1ubuntu5.26","2:8.1.2269-1ubuntu5.29","2:8.1.2269-1ubuntu5.30","2:8.1.2269-1ubuntu5.31"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.24"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11","2:8.2.3995-1ubuntu2.12","2:8.2.3995-1ubuntu2.13","2:8.2.3995-1ubuntu2.15","2:8.2.3995-1ubuntu2.16","2:8.2.3995-1ubuntu2.17","2:8.2.3995-1ubuntu2.18","2:8.2.3995-1ubuntu2.19","2:8.2.3995-1ubuntu2.20","2:8.2.3995-1ubuntu2.21","2:8.2.3995-1ubuntu2.22","2:8.2.3995-1ubuntu2.23"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0016-1ubuntu7.8"}]}],"versions":["2:9.0.1672-1ubuntu2","2:9.0.2087-1ubuntu1","2:9.0.2116-1ubuntu1","2:9.0.2116-1ubuntu2","2:9.0.2184-0ubuntu1","2:9.0.2189-1ubuntu1","2:9.1.0-1ubuntu1","2:9.1.0016-1ubuntu2","2:9.1.0016-1ubuntu6","2:9.1.0016-1ubuntu7","2:9.1.0016-1ubuntu7.1","2:9.1.0016-1ubuntu7.2","2:9.1.0016-1ubuntu7.3","2:9.1.0016-1ubuntu7.4","2:9.1.0016-1ubuntu7.5","2:9.1.0016-1ubuntu7.6","2:9.1.0016-1ubuntu7.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm21"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3","2:7.4.052-1ubuntu3.1+esm4","2:7.4.052-1ubuntu3.1+esm5","2:7.4.052-1ubuntu3.1+esm6","2:7.4.052-1ubuntu3.1+esm7","2:7.4.052-1ubuntu3.1+esm8","2:7.4.052-1ubuntu3.1+esm9","2:7.4.052-1ubuntu3.1+esm10","2:7.4.052-1ubuntu3.1+esm11","2:7.4.052-1ubuntu3.1+esm12","2:7.4.052-1ubuntu3.1+esm13","2:7.4.052-1ubuntu3.1+esm14","2:7.4.052-1ubuntu3.1+esm15","2:7.4.052-1ubuntu3.1+esm16","2:7.4.052-1ubuntu3.1+esm17","2:7.4.052-1ubuntu3.1+esm18","2:7.4.052-1ubuntu3.1+esm19","2:7.4.052-1ubuntu3.1+esm20"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm27"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2","2:7.4.1689-3ubuntu1.5+esm3","2:7.4.1689-3ubuntu1.5+esm4","2:7.4.1689-3ubuntu1.5+esm5","2:7.4.1689-3ubuntu1.5+esm6","2:7.4.1689-3ubuntu1.5+esm7","2:7.4.1689-3ubuntu1.5+esm8","2:7.4.1689-3ubuntu1.5+esm10","2:7.4.1689-3ubuntu1.5+esm11","2:7.4.1689-3ubuntu1.5+esm12","2:7.4.1689-3ubuntu1.5+esm13","2:7.4.1689-3ubuntu1.5+esm14","2:7.4.1689-3ubuntu1.5+esm15","2:7.4.1689-3ubuntu1.5+esm17","2:7.4.1689-3ubuntu1.5+esm18","2:7.4.1689-3ubuntu1.5+esm19","2:7.4.1689-3ubuntu1.5+esm20","2:7.4.1689-3ubuntu1.5+esm22","2:7.4.1689-3ubuntu1.5+esm23","2:7.4.1689-3ubuntu1.5+esm24","2:7.4.1689-3ubuntu1.5+esm25","2:7.4.1689-3ubuntu1.5+esm26"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm12"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9","2:8.0.1453-1ubuntu1.10","2:8.0.1453-1ubuntu1.11","2:8.0.1453-1ubuntu1.12","2:8.0.1453-1ubuntu1.13","2:8.0.1453-1ubuntu1.13+esm1","2:8.0.1453-1ubuntu1.13+esm3","2:8.0.1453-1ubuntu1.13+esm4","2:8.0.1453-1ubuntu1.13+esm5","2:8.0.1453-1ubuntu1.13+esm6","2:8.0.1453-1ubuntu1.13+esm7","2:8.0.1453-1ubuntu1.13+esm8","2:8.0.1453-1ubuntu1.13+esm9","2:8.0.1453-1ubuntu1.13+esm10","2:8.0.1453-1ubuntu1.13+esm11"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.32"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9","2:8.1.2269-1ubuntu5.11","2:8.1.2269-1ubuntu5.12","2:8.1.2269-1ubuntu5.13","2:8.1.2269-1ubuntu5.14","2:8.1.2269-1ubuntu5.15","2:8.1.2269-1ubuntu5.16","2:8.1.2269-1ubuntu5.17","2:8.1.2269-1ubuntu5.18","2:8.1.2269-1ubuntu5.20","2:8.1.2269-1ubuntu5.21","2:8.1.2269-1ubuntu5.22","2:8.1.2269-1ubuntu5.23","2:8.1.2269-1ubuntu5.24","2:8.1.2269-1ubuntu5.25","2:8.1.2269-1ubuntu5.26","2:8.1.2269-1ubuntu5.29","2:8.1.2269-1ubuntu5.30","2:8.1.2269-1ubuntu5.31"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.24"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11","2:8.2.3995-1ubuntu2.12","2:8.2.3995-1ubuntu2.13","2:8.2.3995-1ubuntu2.15","2:8.2.3995-1ubuntu2.16","2:8.2.3995-1ubuntu2.17","2:8.2.3995-1ubuntu2.18","2:8.2.3995-1ubuntu2.19","2:8.2.3995-1ubuntu2.20","2:8.2.3995-1ubuntu2.21","2:8.2.3995-1ubuntu2.22","2:8.2.3995-1ubuntu2.23"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0016-1ubuntu7.8"}]}],"versions":["2:9.0.1672-1ubuntu2","2:9.0.2087-1ubuntu1","2:9.0.2116-1ubuntu1","2:9.0.2116-1ubuntu2","2:9.0.2184-0ubuntu1","2:9.0.2189-1ubuntu1","2:9.1.0-1ubuntu1","2:9.1.0016-1ubuntu2","2:9.1.0016-1ubuntu6","2:9.1.0016-1ubuntu7","2:9.1.0016-1ubuntu7.1","2:9.1.0016-1ubuntu7.2","2:9.1.0016-1ubuntu7.3","2:9.1.0016-1ubuntu7.4","2:9.1.0016-1ubuntu7.5","2:9.1.0016-1ubuntu7.6","2:9.1.0016-1ubuntu7.7"],"bundled":2}],"products":[{"vendor":"netapp","product":"hci_compute_node"},{"vendor":"vim","product":"vim"}],"references":[{"url":"https://github.com/vim/vim/security/advisories/GHSA-63p5-mwg2-787v","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","report"]},{"url":"https://github.com/vim/vim/commit/c0f0e2380e5954f4a52a131bf6b8","tags":["x_refsource_MISC","Patch","fix","report"]},{"url":"https://security.netapp.com/advisory/ntap-20250306-0003/","tags":["Third Party Advisory","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-26603","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26603","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-26603","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2025-1756928197.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778259521.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779214181.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26603.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-26603","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0074.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34035","tags":["report"]},{"url":"https://openwall.com/lists/oss-security/2025/02/16/1","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1215","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-26603","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-26603","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7419-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-1215","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-26603","title":"heap-use-after-free in function str_to_reg in vim/vim","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-18T19:04:24.273Z","modified":"2025-03-07T00:10:51.265Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:32:27.932735Z"}],"euvd":[{"id":"EUVD-2025-5099","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-18T19:04:24Z","modified":"2025-03-07T00:10:51Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:10.661676Z"}],"nvd":[{"id":"CVE-2025-26603","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-18T19:15:29.387Z","modified":"2026-06-17T09:02:06.7Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:10:51.445921Z"}],"osv":[{"id":"ALPINE-CVE-2025-26603","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-18T19:15:29.387Z","modified":"2026-11-03T06:33:00.639919219Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"BELL-CVE-2025-26603","status":"published","published":"2025-02-20T05:57:01.979389Z","modified":"2026-08-25T08:25:28.713922Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:21.741325Z"},{"id":"CVE-2025-26603","title":"heap-use-after-free in function str_to_reg in vim/vim","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-18T19:04:24.273Z","modified":"2026-11-11T13:04:28.57528351Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2025-26603","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-18T19:15:29.387Z","modified":"2026-09-01T20:05:44.987198626Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"OESA-2025-1231","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.(CVE-2025-1215)\n\nVim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2025-26603)","status":"published","published":"2025-02-28T11:08:19Z","modified":"2026-08-18T01:18:49.245008514Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2025-26603","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-18T19:15:00Z","modified":"2026-02-04T19:54:40.552325Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"AZL-56913","title":"CVE-2025-26603 affecting package vim for versions less than 9.1.0791-4","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-18T19:15:29Z","modified":"2026-04-21T04:36:49.035687Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"AZL-56962","title":"CVE-2025-26603 affecting package vim for versions less than 9.1.0791-4","description":"Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2025-02-18T19:15:29Z","modified":"2026-04-21T04:49:21.652454Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"CLSA-2025-1756928197","title":"Fix CVE(s): CVE-2025-26603","description":"   * SECURITY UPDATE: fix use-after-free vulnerability in buffer closing\n     - debian/patches/CVE-2025-26603.patch: Fix heap use-after-free\n       in str_to_reg()\n     - CVE-2025-26603","status":"published","published":"2025-09-03T19:36:41Z","modified":"2026-06-04T10:03:37.482389Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1778259521","title":"vim: Fix of 4 CVEs","description":"- CVE-2022-3278: fix crash when using NUL in buffer that uses :source;\n  don't get a next line when skipping over NL in eval_next_non_blank()\n  (eval.c, upstream patch 9.0.0552)\n- CVE-2023-48234: fix overflow when getting count for normal z command;\n  break out of nv_zet() count loop when n \u003e LONG_MAX/10 (normal.c,\n  upstream patch 9.0.2109)\n- CVE-2023-48236: fix overflow in get_number() when using z= with a\n  large count; return 0 when n \u003e INT_MAX/10 (misc1.c, upstream patch\n  9.0.2111)\n- CVE-2025-26603: fix use-after-free in str_to_reg() when redirecting\n  :display to a clipboard register; skip the active redir register\n  including the * and + clipboard fallbacks to register 0 (register.c,\n  upstream patch 9.1.1115)","status":"published","published":"2026-05-08T16:58:46Z","modified":"2026-06-01T00:32:29.858636495Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779214181","title":"vim: Fix of 4 CVEs","description":"- CVE-2022-3278: fix crash when using NUL in buffer that uses :source;\n  don't get a next line when skipping over NL in eval_next_non_blank()\n  (eval.c, upstream patch 9.0.0552)\n- CVE-2023-48234: fix overflow when getting count for normal z command;\n  break out of nv_zet() count loop when n \u003e LONG_MAX/10 (normal.c,\n  upstream patch 9.0.2109)\n- CVE-2023-48236: fix overflow in get_number() when using z= with a\n  large count; return 0 when n \u003e INT_MAX/10 (misc1.c, upstream patch\n  9.0.2111)\n- CVE-2025-26603: fix use-after-free in str_to_reg() when redirecting\n  :display to a clipboard register; skip the active redir register\n  including the * and + clipboard fallbacks to register 0 (register.c,\n  upstream patch 9.1.1115)","status":"published","published":"2026-05-19T18:09:50Z","modified":"2026-06-01T00:32:53.548204563Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"MGASA-2025-0074","title":"Updated vim packages fix security vulnerability","description":"A heap use-after-free was found in str_to_reg() in Vim \u003c 9.1.1115.\n(CVE-2025-26603)\n","status":"published","published":"2025-02-25T16:58:04Z","modified":"2026-04-16T04:44:41.659823519Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"USN-7419-1","title":"vim vulnerabilities","description":"It was discovered that Vim incorrectly handled memory when using invalid\ninput with the log option. An attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 24.04 LTS and\nUbuntu 24.10. (CVE-2025-1215)\n\nIt was discovered that Vim incorrectly handled memory when redirecting\ncertain output to the register. An attacker could possibly use this issue\nto cause a denial of service. (CVE-2025-26603)\n","status":"published","published":"2025-04-07T13:01:23Z","modified":"2026-06-25T13:32:30.356336311Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}