Cloudanix VulnDB

CVE-2025-22134

Medium · 4.2

CVSS

4.2

EPSS

0.4%

Published

Jan 13, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Vim text editor can let someone who already has access to your computer cause it to read or write memory it shouldn't when using certain editing commands, potentially crashing the program or allowing limited unauthorized actions.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
High
Impact
Other
Component
Application
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Heap-buffer overflow triggered when the :all ex command switches buffers while visual mode remains active, allowing access beyond the end of a line without proper visual mode reset or bounds checking.

Why it matters to the business

Developers using Vim may experience editor crashes or limited memory corruption that could lead to arbitrary code execution in rare cases, disrupting editing workflows and source code handling across many environments.

How an attack unfolds

An attacker with local access enables visual mode, then issues the :all command to force buffer switching; Vim fails to exit visual mode cleanly and reads past the current line boundary, resulting in heap corruption that may be leveraged for limited code execution.

How to fix it

Upgrade Vim to patch 9.1.1003 or later; apply commit c9a1e257f1630a0866447e53a564f7ff96a80ead for source builds; verify the visual mode reset and bounds check logic are present before reopening other buffers.

How to confirm the fix worked

Confirm Vim reports patch level 9.1.1003 or higher; reproduce the :all command while visual mode is active and verify no crash or out-of-bounds access occurs; review source for explicit visual mode reset before buffer switches.

Typical attack path

  1. Obtain local access to a system running an affected Vim build
  2. Enter visual mode in an open buffer
  3. Execute the :all ex command to trigger buffer/window switching
  4. Trigger out-of-bounds memory access during visual mode state handling

How to detect it

Review process execution logs or shell history for sequences containing visual mode activation followed by the :all command; inspect core dumps or crash reports showing heap-buffer overflows in Vim buffer handling routines.

What your security team should do

  • Immediately update all Vim installations to the fixed commit or patch 9.1.1003
  • Audit developer workstations and CI environments for outdated Vim binaries
  • Restrict use of visual mode combined with buffer-switching commands until patched
  • Monitor for any new public exploit code targeting this memory corruption path

The record

When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003

Affected packages

Ecosystem Package Introduced Fixed
Alpine:v3.21 vim 0 9.1.1003-r0
Alpine:v3.22 vim 0 9.1.1003-r0
Debian:11 vim 0 No fix
Debian:12 vim 0 No fix
Debian:13 vim 0 No fix
Debian:14 vim 0 2:9.1.1113-1
Mageia:9 vim 0 9.1.1012-1.mga9
SUSE:Linux Enterprise Micro 5.1 vim 0 9.1.1101-150000.5.69.1
SUSE:Linux Enterprise Micro 5.2 vim 0 9.1.1101-150000.5.69.1
SUSE:Linux Enterprise Micro 5.3 vim 0 9.1.1101-150000.5.69.1
SUSE:Linux Enterprise Micro 5.4 vim 0 9.1.1101-150000.5.69.1
SUSE:Linux Enterprise Micro 5.5 vim 0 9.1.1101-150500.20.21.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 vim 0 9.1.1101-150500.20.21.1
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 vim 0 9.1.1101-150500.20.21.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 vim 0 9.1.1101-17.41.1
Ubuntu:20.04:LTS vim 0 2:8.1.2269-1ubuntu5.30
Ubuntu:20.04:LTS vim 0 No fix
Ubuntu:22.04:LTS vim 0 2:8.2.3995-1ubuntu2.22
Ubuntu:22.04:LTS vim 0 No fix
Ubuntu:24.04:LTS vim 0 2:9.1.0016-1ubuntu7.6
Ubuntu:24.04:LTS vim 0 No fix
Ubuntu:24.10 vim 0 2:9.1.0496-1ubuntu6.3
Ubuntu:24.10 vim 0 No fix
Ubuntu:Pro:14.04:LTS vim 0 No fix
Ubuntu:Pro:16.04:LTS vim 0 No fix
Ubuntu:Pro:18.04:LTS vim 0 No fix
openSUSE:Leap 15.6 vim 0 9.1.1101-150500.20.21.1

Related vulnerabilities