Use-After-Free Vulnerability in Vim Package: CVE-2025-26603
Summary
DEBIAN-CVE-2025-26603: Vim is a greatly improved version of the good old UNIX editor Vi. Affects vim versions < 2:9.1.1230-1. Fixed in 2:9.1.1230-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is an enhanced version of the classic UNIX editor Vi, known for its powerful features and flexibility. It allows users to redirect screen messages and display register contents, making it a popular choice among developers and system administrators. However, a vulnerability has been identified that affects its handling of register content, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from Vim's handling of register content when using the ':redir' and ':display' commands. Specifically, when redirecting output to a register that is currently being displayed, Vim may free the register's content prematurely, leading to a use-after-free condition. This flaw was introduced in versions prior to 9.1.1115, where checks to prevent this issue were incomplete, particularly for the clipboard registers ('*' and '+'). The ramifications include potential crashes or exploitation by attackers who can manipulate register content during this operation.
How To Fix
Minimum fixed version
2:9.1.1230-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. Users are strongly advised to upgrade to the patched version to mitigate any risks.
Conclusion
In summary, CVE-2025-26603 is a significant vulnerability in the Vim text editor that can lead to serious security issues if not addressed. Users are encouraged to upgrade to the latest patched version to ensure their systems remain secure.
See every vulnerability recorded for vim →
FAQ
CVE-2025-26603 is a use-after-free vulnerability in the Vim text editor that can lead to crashes or potential exploitation.
You can check your Vim version by running the command 'vim --version' in your terminal. If it is below 2:9.1.1230-1, it is affected.
While there are no workarounds available, it is crucial to plan an upgrade as soon as possible to avoid potential security risks.
Detailed information about CVE-2025-26603 can be found in the Debian security advisories and vulnerability databases.
Yes, Vulert can monitor your open-source dependencies for vulnerabilities in real-time using a manifest file like package-lock.json. You can check your application against this vulnerability using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
