CVE-2025-55158

MEDIUM EPSS 24.8%
Published Aug 11, 202510mo ago · Modified Jun 17, 20262w ago
6.9 CVSS 4.0
Medium
Find Similar
Published Aug 11, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1406, when processing nested tuples during Vim9 script import operations, an error during evaluation can trigger a double-free in Vim’s internal typed value (typval_T) management. Specifically, the clear_tv() function may attempt to free memory that has already been deallocated, due to improper lifetime handling in the handle_import / ex_import code paths. The vulnerability can only be triggered if a user explicitly opens and executes a specially crafted Vim script. This issue has been patched in version 9.1.1406.

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
24.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-415

Affected Products 1

VendorProductVersionRange
vimvim*≥9.1.1231  –  <9.1.1406

References 3

  • github.com https://github.com/vim/vim/commit/9772025d24e939fd84b85748ce35c26874c05775
    Patch
  • github.com https://github.com/vim/vim/releases/tag/v9.1.1406
    Patch
  • github.com https://github.com/vim/vim/security/advisories/GHSA-5fg8-wvx3-583x
    Vendor Advisory

Remediation

  • github.com https://github.com/vim/vim/commit/9772025d24e939fd84b85748ce35c26874c05775
    Patch
  • github.com https://github.com/vim/vim/releases/tag/v9.1.1406
    Patch