This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Vim fixes two vulnerabilities
Vim version 9.1.1406 fixes 2 vulnerabilities [1][2].
An authenticated local attacker, due to improper handling of nested tuples in a Vim script, is able to trigger a use-after-free vulnerability in the tuple_unref() function, which may lead to memory corruption [1][3].
The vulnerability is present in product:
- Vim; >9.1.1231, <9.1.1400
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-55157 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 10. 8. 2025.
An unauthenticated local attacker, due to improper handling of nested tuples during import in a Vim script, leading to a double-free vulnerability in the clear_tv() function as a result of incorrect memory management in the handle_import / ex_import code, is able to cause memory corruption [2][4].
The vulnerability is present in product:
- Vim; >9.1.1231, <9.1.1406
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
More information:
- CVE-2025-55158 at cve.org, NVD
- CWE-415: Double Free at cwe.mitre.org
The vulnerability was publicly disclosed 10. 8. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 12. 8. 2025.