CVE-2025-26603

None

CVSS

—

EPSS

0.2%

Published

Feb 18, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Vim text editor can let attackers run their own code on a computer if someone opens a specially made file or command.

Exploitation: Requires User Interaction
Attacker needs: User Interaction
Complexity: Moderate
Impact: Denial Of Service
Component: Application
Class: Use After Free
Remediation: Upgrade
Effort: Low
Patch risk: Low

What it actually does

Use-after-free occurs in ex_display() when output from :display is redirected via :redir to the * or + registers (clipboard) while those registers are simultaneously being displayed; the incomplete check allows freeing register content before a subsequent access.

Why it matters to the business

Attackers may achieve arbitrary code execution on developer workstations or build systems by tricking users into opening specially crafted files or running malicious ex commands, leading to potential supply-chain compromise or data theft.

How an attack unfolds

An attacker supplies a Vim script or buffer containing :redir and :display commands targeting the clipboard registers; the incomplete register check allows the freed memory to be accessed, enabling memory corruption that can be turned into code execution.

How to fix it

Upgrade vim/vim to commit c0f0e2380e5954f4a52a131bf6b8499838ad1dae or later (corresponding to patch 9.1.1115). No workarounds exist.

How to confirm the fix worked

Confirm the installed Vim reports a build containing commit c0f0e2380e5954f4a52a131bf6b8499838ad1dae; test that :redir to * / + registers while displaying them no longer triggers the crash or sanitizer reports.

Typical attack path

Craft a Vim script or file that issues :redir > @* (or @+) followed by :display @* while the register is active.
Deliver the file to a target user or environment and induce opening in an unpatched Vim instance.
Trigger the command sequence to cause the use-after-free and corrupt memory.
Leverage the resulting primitive to execute attacker-controlled code.

How to detect it

Review Vim command history, .vimrc, and session logs for sequences combining :redir with :display on * or + registers; look for crashes or ASAN/Valgrind reports referencing ex_display and register freeing.

What your security team should do

Immediately update all Vim installations to the fixed commit across developer and CI environments.
Block or scan for inbound files containing suspicious :redir / :display combinations targeting clipboard registers.
Monitor EPSS and exploit maturity; prepare incident response playbooks for editor-based code execution.

The record

Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages

Ecosystem	Package	Fixed
Alpine:v3.22	vim	9.1.1164-r0
Debian:11	vim	No fix
Debian:12	vim	No fix
Debian:13	vim	No fix
Debian:14	vim	2:9.1.1230-1
Mageia:9	vim	9.1.1122-1.mga9