Heap Buffer Overflow Vulnerability in Vim Package: CVE-2025-22134
Summary
UBUNTU-CVE-2025-22134: When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the e... Affects vim versions 2:7.4.000-1ubuntu2 – 2:7.4.052-1ubuntu3.1+esm9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vim is a highly configurable text editor built to enable efficient text editing. It is widely used by programmers and system administrators for its powerful features, including syntax highlighting, multi-level undo, and support for various programming languages. However, Vim has been found to have a vulnerability that can lead to a heap buffer overflow when switching buffers while visual mode is active, potentially compromising system stability and security.
Vulnerability Detail
The vulnerability identified as CVE-2025-22134 arises when users switch to other buffers using the ':all' command while visual mode is still active. This can lead to a heap buffer overflow because Vim fails to properly terminate visual mode, which may result in attempts to access memory beyond the end of a buffer line. The impact is classified as medium, as it requires the user to have visual mode enabled during the execution of the ':all' command. The issue has been addressed in Vim patch v9.1.1003, which ensures that visual mode is reset correctly before opening other windows and buffers, thus preventing the overflow.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the ':all' command while visual mode is active. Instead, they should exit visual mode before switching buffers to prevent triggering the vulnerability.
Conclusion
CVE-2025-22134 represents a significant vulnerability in the Vim text editor that can lead to heap buffer overflows under specific conditions. Users are advised to update their Vim installations to the latest patched versions to mitigate potential risks. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for vim →
FAQ
CVE-2025-22134 is a vulnerability in the Vim text editor that can lead to a heap buffer overflow when switching buffers while visual mode is active.
You can check your Vim version by running 'vim --version' in the terminal. If your version is earlier than 2:9.1.0016-1ubuntu7.6, it is affected.
Not addressing this vulnerability could lead to system instability, crashes, or potential exploitation by malicious actors to execute arbitrary code.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
