Heap Buffer Overflow in Vim When Switching Buffers
Summary
CVE-2025-22134: When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the e... Affects vim versions < 9.1.1003-r0. Fixed in 9.1.1003-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a highly configurable text editor used for efficiently creating and editing any kind of text. It is known for its powerful features, including multiple modes for editing, extensive plugin support, and a strong community. However, Vim is susceptible to certain vulnerabilities, including a recent issue that can lead to a heap buffer overflow when users switch buffers while in visual mode.
Vulnerability Detail
The vulnerability, identified as CVE-2025-22134, occurs when users switch to other buffers using the ':all' command while visual mode is still active. This improper handling of visual mode can lead to a heap buffer overflow, as Vim may attempt to access memory beyond the end of a line in a buffer. The impact is classified as medium since the user must have visual mode enabled when executing the ':all' command. The issue was reported by a GitHub user and has been addressed in Vim patch v9.1.1003.
How To Fix
Minimum fixed version
9.1.1003-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the ':all' command while in visual mode until they can apply the patch. It is advisable to exit visual mode before switching buffers.
Conclusion
The vulnerability CVE-2025-22134 in Vim poses a medium risk due to improper handling of visual mode when switching buffers. Users are encouraged to update to the patched version 9.1.1003 to mitigate this risk and should consider using tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for vim →
FAQ
CVE-2025-22134 is a vulnerability in Vim that can lead to a heap buffer overflow when switching buffers while visual mode is active.
If you are using a version of Vim prior to patch v9.1.1003, your installation may be vulnerable to this issue.
The risks include potential crashes or unexpected behavior in Vim, which could lead to data loss or corruption.
Yes, tools like Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without requiring code access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
