CVE-2025-55157

MEDIUM EPSS 23.8%
Published Aug 11, 202510mo ago · Modified Jun 17, 20262w ago
6.9 CVSS 4.0
Medium
Find Similar
Published Aug 11, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1400, When processing nested tuples in Vim script, an error during evaluation can trigger a use-after-free in Vim’s internal tuple reference management. Specifically, the tuple_unref() function may access already freed memory due to improper lifetime handling, leading to memory corruption. The exploit requires direct user interaction, as the script must be explicitly executed within Vim. This issue has been patched in version 9.1.1400.

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
23.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 1

VendorProductVersionRange
vimvim*≥9.1.1231  –  <9.1.1400

References 3

  • github.com https://github.com/vim/vim/commit/1307743697bbc46e1518abfea7f89caa95bcaf97
    Patch
  • github.com https://github.com/vim/vim/releases/tag/v9.1.1400
    Patch
  • github.com https://github.com/vim/vim/security/advisories/GHSA-3r4f-mm4w-wgg6
    Vendor Advisory

Remediation

  • github.com https://github.com/vim/vim/commit/1307743697bbc46e1518abfea7f89caa95bcaf97
    Patch
  • github.com https://github.com/vim/vim/releases/tag/v9.1.1400
    Patch