CVE-2025-1215

vim main.c memory corruption

State: Published
Severity: 2.4 Low
Published: Feb 12, 2025
Updated: Mar 21, 2025
Reserved: Feb 10, 2025

Description

A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	2.4 Low	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	2.8 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L	VulDB
3.0	2.8 Low	CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L	VulDB
2.0	1.7 Low	AV:L/AC:L/Au:S/C:N/I:N/A:P	VulDB

Weaknesses

CWE-119 Memory Corruption

Affected Products

Product	Versions
vimn/a	9.1.1096Affected

References

VDB-295174 | vim main.c memory corruptionvdb-entrytechnical-description
VDB-295174 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #497546 | VIM vim 68d08588928b29fe0b19e3513cd689486260ab1c illegal read accessthird-party-advisory
https://github.com/vim/vim/issues/16606issue-tracking
https://github.com/vim/vim/commit/c5654b84480822817bb7b69ebc97c174c91185e9patch
https://github.com/vim/vim/releases/tag/v9.1.1097patch
https://security.netapp.com/advisory/ntap-20250321-0005/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.