Heap Buffer Overflow in Vim: Vulnerability ALPINE-CVE-2025-22134
Summary
ALPINE-CVE-2025-22134: When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the e... Affects vim versions < 9.1.1003-r0. Fixed in 9.1.1003-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a highly configurable text editor built to enable efficient text editing. It is widely used by developers and system administrators for its powerful features, including syntax highlighting, multi-level undo, and extensive plugin support. However, Vim versions prior to 9.1.1003-r0 are susceptible to a heap buffer overflow vulnerability when switching buffers while visual mode is active, potentially leading to unexpected behavior.
Vulnerability Detail
The vulnerability arises when users switch to other buffers using the ':all' command while visual mode remains active. This can lead to a heap-buffer overflow because Vim fails to properly terminate visual mode, which may result in attempts to access memory beyond the end of a buffer line. The impact is classified as medium, as it requires the user to have visual mode enabled during the execution of the ':all' command. The issue has been addressed in Vim patch v9.1.1003, which ensures that visual mode is reset before opening new windows and buffers, and includes checks to prevent accessing out-of-bounds positions.
How To Fix
Minimum fixed version
9.1.1003-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the ':all' command while visual mode is active until the package is updated to the patched version. Alternatively, you can exit visual mode before executing the ':all' command.
Conclusion
In summary, the heap buffer overflow vulnerability in Vim (ALPINE-CVE-2025-22134) poses a medium risk to users who utilize visual mode while switching buffers. It is crucial to update to the patched version 9.1.1003-r0 to mitigate this risk. Users are encouraged to follow the provided steps for updating and to consider the temporary workaround until the update can be applied.
See every vulnerability recorded for vim →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update Vim right away, avoid using the ':all' command while visual mode is active as a temporary workaround.
The vulnerability was reported by a GitHub user known as gandalf4a.
Exploiting this vulnerability could lead to unexpected behavior in Vim, including crashes or data corruption, as it may allow access to invalid memory locations.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
