Cloudanix VulnDB

CVE-2025-24014

None

CVSS

—

EPSS

0.3%

Published

Jan 20, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Vim text editor can cause it to crash unexpectedly when given certain special inputs while running quietly in the background.

Exploitation
Requires User Interaction
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Causes a segmentation fault by accessing an unallocated ScreenLines pointer when binary characters are fed to Vim running in silent Ex mode (-s -e), triggering a redraw in a GUI scrolling function despite no screen allocation.

Why it matters to the business

May lead to crashes in automated Vim usage or batch processing, disrupting text editing workflows or scripts relying on Vim.

How an attack unfolds

An attacker supplies specially crafted binary input to Vim invoked with -s -e flags, causing the scrolling handler to attempt a redraw on an uninitialized pointer.

How to fix it

Upgrade Vim to the fixed commit 9d1bed5eccdbb46a26b8a484f5e9163c40e63919 or later version 9.1.1043.

How to confirm the fix worked

Verify Vim version is at least 9.1.1043 and test with binary input in silent mode to confirm no crash.

Typical attack path

  1. Invoke Vim with silent Ex mode flags
  2. Feed binary characters as input
  3. Trigger scrolling function to cause segfault

How to detect it

Look for segmentation fault logs or core dumps from Vim processes invoked with -s -e flags.

What your security team should do

  • Update Vim to the patched version immediately
  • Review scripts using Vim in batch mode for potential exposure
  • Monitor for crashes in Vim processes

The record

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

Affected packages

Ecosystem Package Introduced Fixed
Alpine:v3.21 vim 0 9.1.1105-r0
Alpine:v3.22 vim 0 9.1.1105-r0
Debian:11 vim 0 No fix
Debian:12 vim 0 No fix
Debian:13 vim 0 No fix
Debian:14 vim 0 2:9.1.1113-1
Mageia:9 vim 0 9.1.1043-1.mga9
SUSE:Linux Enterprise Micro 5.1 vim 0 9.1.1101-150000.5.69.1
SUSE:Linux Enterprise Micro 5.2 vim 0 9.1.1101-150000.5.69.1
SUSE:Linux Enterprise Micro 5.3 vim 0 9.1.1101-150000.5.69.1
SUSE:Linux Enterprise Micro 5.4 vim 0 9.1.1101-150000.5.69.1
SUSE:Linux Enterprise Micro 5.5 vim 0 9.1.1101-150500.20.21.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 vim 0 9.1.1101-150500.20.21.1
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 vim 0 9.1.1101-150500.20.21.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 vim 0 9.1.1101-17.41.1
Ubuntu:20.04:LTS vim 0 No fix
Ubuntu:20.04:LTS vim 0 2:8.1.2269-1ubuntu5.31
Ubuntu:22.04:LTS vim 0 No fix
Ubuntu:22.04:LTS vim 0 2:8.2.3995-1ubuntu2.23
Ubuntu:24.04:LTS vim 0 No fix
Ubuntu:24.04:LTS vim 0 2:9.1.0016-1ubuntu7.7
Ubuntu:24.10 vim 0 No fix
Ubuntu:25.04 vim 0 2:9.1.0967-1ubuntu4
Ubuntu:25.10 vim 0 2:9.1.0967-1ubuntu4
Ubuntu:Pro:14.04:LTS vim 0 No fix
Ubuntu:Pro:14.04:LTS vim 0 2:7.4.052-1ubuntu3.1+esm22
Ubuntu:Pro:16.04:LTS vim 0 No fix
Ubuntu:Pro:16.04:LTS vim 0 2:7.4.1689-3ubuntu1.5+esm28
Ubuntu:Pro:18.04:LTS vim 0 No fix
Ubuntu:Pro:18.04:LTS vim 0 2:8.0.1453-1ubuntu1.13+esm13
openSUSE:Leap 15.6 vim 0 9.1.1101-150500.20.21.1

Related vulnerabilities