Debian Vim vulnerabilities

CVE-2025-53905 [MEDIUM] CVE-2025-53905: vim - Vim is an open source, command line text editor. Prior to version 9.1.1552, a pa... Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing execut

CVE-2023-46246 [MEDIUM] CVE-2023-46246: vim - Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free i... Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the p

CVE-2026-32249 [MEDIUM] CVE-2026-32249: vim - Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.013... Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_

CVE-2024-43802 [MEDIUM] CVE-2024-43802: vim - Vim is an improved version of the unix vi text editor. When flushing the typeahe... Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then

CVE-2022-1420 [MEDIUM] CVE-2022-1420: vim - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.477... Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774. Scope: local bookworm: resolved (fixed in 2:8.2.4793-1) bullseye: open forky: resolved (fixed in 2:8.2.4793-1) sid: resolved (fixed in 2:8.2.4793-1) trixie: resolved (fixed in 2:8.2.4793-1)

CVE-2026-28420 [MEDIUM] CVE-2026-28420: vim - Vim is an open source, command line text editor. Prior to version 9.2.0076, a he... Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2:9.2.0119-1) sid

CVE-2023-48232 [LOW] CVE-2023-48232: vim - Vim is an open source command line text editor. A floating point exception may o... Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled and the cpo-settings include the 'n' flag. This may happen when a window border is present and when the wrapped line continues on the next physical line directly in the window border because the 'cpo' set

CVE-2024-47814 [LOW] CVE-2024-47814: vim - Vim is an open source, command line text editor. A use-after-free was found in V... Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some

CVE-2022-0696 [MEDIUM] CVE-2022-0696: vim - NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428. NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428. Scope: local bookworm: resolved (fixed in 2:8.2.4659-1) bullseye: open forky: resolved (fixed in 2:8.2.4659-1) sid: resolved (fixed in 2:8.2.4659-1) trixie: resolved (fixed in 2:8.2.4659-1)

CVE-2022-2208 [MEDIUM] CVE-2022-2208: vim - NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. Scope: local bookworm: resolved (fixed in 2:9.0.0135-1) bullseye: open forky: resolved (fixed in 2:9.0.0135-1) sid: resolved (fixed in 2:9.0.0135-1) trixie: resolved (fixed in 2:9.0.0135-1)

CVE-2022-1771 [MEDIUM] CVE-2022-1771: vim - Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975. Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975. Scope: local bookworm: resolved (fixed in 2:9.0.0135-1) bullseye: open forky: resolved (fixed in 2:9.0.0135-1) sid: resolved (fixed in 2:9.0.0135-1) trixie: resolved (fixed in 2:9.0.0135-1)

CVE-2023-2426 [MEDIUM] CVE-2023-2426: vim - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.149... Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. Scope: local bookworm: resolved (fixed in 2:9.0.1378-2) bullseye: resolved forky: resolved (fixed in 2:9.0.1378-2) sid: resolved (fixed in 2:9.0.1378-2) trixie: resolved (fixed in 2:9.0.1378-2)

CVE-2023-48234 [LOW] CVE-2023-48234: vim - Vim is an open source command line text editor. When getting the count for a nor... Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. Th

CVE-2023-48236 [LOW] CVE-2023-48236: vim - Vim is an open source command line text editor. When using the z= command, the u... Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit `73b2d379` which has been included in release version 9.0.2111. Users are advised to upgra

CVE-2025-29768 [MEDIUM] CVE-2025-29768: vim - Vim, a text editor, is vulnerable to potential data loss with zip.vim and specia... Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch v9.1.1198. Scope: local bookworm: open bullseye: resolved forky: reso

CVE-2024-41965 [MEDIUM] CVE-2024-41965: vim - Vim is an open source command line text editor. double-free in dialog_changed() ... Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will fa

CVE-2025-26603 [MEDIUM] CVE-2025-26603: vim - Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to ... Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before stor

CVE-2023-48231 [LOW] CVE-2023-48231: vim - Vim is an open source command line text editor. When closing a window, vim may t... Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for t

CVE-2022-1674 [MEDIUM] CVE-2022-1674: vim - NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitH... NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input. Scope: local bookworm: resolved (fixed in 2:9.0.0135-1) bullseye: open forky: resolved (fix

CVE-2022-2231 [MEDIUM] CVE-2022-2231: vim - NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2. NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2. Scope: local bookworm: resolved (fixed in 2:9.0.0135-1) bullseye: open forky: resolved (fixed in 2:9.0.0135-1) sid: resolved (fixed in 2:9.0.0135-1) trixie: resolved (fixed in 2:9.0.0135-1)