Use-After-Free Vulnerability in Vim Package: CVE-2025-26603
Summary
CVE-2025-26603: Vim is a greatly improved version of the good old UNIX editor Vi. Affects vim versions < 9.1.1164-r0. Fixed in 9.1.1164-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is an advanced text editor that builds upon the traditional UNIX editor, Vi. It offers enhanced features such as syntax highlighting, multi-level undo, and extensive plugin support. Vim allows users to redirect screen messages and display register contents, making it a powerful tool for developers and system administrators. However, a recent vulnerability has been identified that affects its handling of register outputs, particularly when dealing with clipboard registers.
Vulnerability Detail
The vulnerability, identified as CVE-2025-26603, arises from Vim's handling of register outputs during the use of the ':display' command. When redirecting output to a register that is currently being displayed, Vim frees the register's content before accessing it again, leading to a use-after-free condition. This flaw is exacerbated by an incomplete check in the ex_display() function, which fails to account for the '+' and '*' registers, typically associated with clipboard operations. If exploited, this vulnerability could lead to unexpected behavior or crashes, potentially allowing an attacker to execute arbitrary code.
How To Fix
Minimum fixed version
9.1.1164-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. Users are strongly advised to upgrade to the patched version of Vim as soon as possible.
Conclusion
CVE-2025-26603 represents a significant vulnerability in the Vim text editor, specifically affecting its handling of register outputs. Users are strongly encouraged to upgrade to version 9.1.1115 or later to mitigate the risks associated with this vulnerability. Regular monitoring for vulnerabilities using tools like Vulert can further enhance your security posture.
See every vulnerability recorded for vim →
FAQ
CVE-2025-26603 is a use-after-free vulnerability in the Vim text editor that can lead to unexpected behavior or crashes.
Any version of Vim prior to 9.1.1115 is vulnerable to this issue. You can check your version by running 'vim --version' in the terminal.
While there are no workarounds available, it is crucial to prioritize upgrading to the patched version to mitigate the risk.
Exploitation of this vulnerability could lead to crashes or arbitrary code execution, posing a significant security risk.
Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json, without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
