Segmentation Fault Vulnerability in Vim Package - CVE-2025-24014
Summary
ALPINE-CVE-2025-24014: Vim is an open source, command line text editor. Affects vim versions < 9.1.1105-r0. Fixed in 9.1.1105-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a widely used open-source command line text editor known for its efficiency and versatility in text manipulation. It supports various programming languages and is favored by developers for its powerful features, including syntax highlighting, multi-file editing, and extensive customization options. However, like any software, it is susceptible to vulnerabilities that can impact its functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2025-24014 is a segmentation fault that occurs in Vim versions prior to 9.1.1043. This issue arises when Vim operates in silent Ex mode (-s -e), which typically suppresses screen output. Despite this, a flaw allows the function responsible for scrolling in the GUI version of Vim to be triggered by feeding binary characters. This can lead to an attempt to access the ScreenLines pointer, which has not been allocated, resulting in a segmentation fault. The ramifications of this vulnerability could lead to unexpected behavior or crashes, potentially exposing users to further security risks.
How To Fix
Minimum fixed version
9.1.1105-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Vim in silent Ex mode until the package is updated. This can help prevent triggering the vulnerability while a permanent fix is being implemented.
Conclusion
In summary, CVE-2025-24014 represents a significant vulnerability in the Vim text editor that can lead to segmentation faults under specific conditions. Users are advised to update to the latest version to mitigate risks. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for vim →
FAQ
CVE-2025-24014 is a segmentation fault vulnerability found in Vim versions prior to 9.1.1043, which can be triggered in silent Ex mode.
You can check your Vim version by running 'vim --version' in the terminal. If it is below 9.1.1105-r0, it is affected.
The vulnerability can lead to crashes and unexpected behavior in Vim, which may disrupt workflows and expose users to additional security risks.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities at Vulert Scanner.
The CVSS score for CVE-2025-24014 is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
