CVE-2025-9389
vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption
- State
- Published
- Severity
- 4.8 Medium
- Published
- Aug 24, 2025
- Updated
- Aug 25, 2025
- Reserved
- Aug 23, 2025
Description
A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, "when coloring is turned on".
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.3 Low | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 3.3 Low | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 1.7 Low | AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
- CWE-119 Memory Corruption
Affected Products
| Product | Versions |
|---|---|
vimn/a |
|
References
- VDB-321222 | vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruptionvdb-entrytechnical-description
- VDB-321222 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #630898 | vim xxd vim-9.1.0000 and related xxd versions (latest master branch) Memory Corruptionthird-party-advisory
- https://github.com/vim/vim/issues/17940issue-tracking
- https://github.com/vim/vim/issues/17940#issuecomment-3203415781issue-tracking
- https://drive.google.com/file/d/1iFbTpW79vqBPkFjWYzGYIh_E6esPhYVY/view?usp=sharingexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.