CVE-2025-24014

MEDIUM EPSS 17.4%
Published Jan 20, 20251y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jan 20, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

CVSS Details

Base Score
5.5
Exploitability
0.8
Impact
4.7
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity Low
Availability High

Threat Intelligence

EPSS Exploit Probability
17.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 3

VendorProductVersionRange
vimvim* <9.1.1043
netapphci_compute_node_firmware*any
netapphci_compute_node*any

References 5

  • openwall.com http://www.openwall.com/lists/oss-security/2025/01/20/4
    Mailing List
  • openwall.com http://www.openwall.com/lists/oss-security/2025/01/21/1
    Mailing List
  • github.com https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919
    Patch
  • github.com https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955
    Vendor Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20250314-0005/
    Third Party Advisory

Remediation

  • github.com https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919
    Patch