CVE catalog

CVE-2025-26603

Vim vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 4.2CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.24% · Oct 25, 2026

Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianvimsid2:9.2.0858-1fixed
Debianvimforky2:9.2.0858-1fixed
Debianvimtrixie2:9.1.1230-2fixed
Debianvimbookworm2:9.0.1378-2+deb12u2vulnerable
UbuntuvimnobleNot reportedvulnerable
Ubuntuvimnoble2:9.1.0016-1ubuntu7.8fixed
Ubuntuvim-athenanoble2:9.1.0016-1ubuntu7.8fixed
Ubuntuvim-commonnoble2:9.1.0016-1ubuntu7.8fixed
Ubuntuvim-docnoble2:9.1.0016-1ubuntu7.8fixed
Ubuntuvim-gtk3noble2:9.1.0016-1ubuntu7.8fixed
Ubuntuvim-gui-commonnoble2:9.1.0016-1ubuntu7.8fixed
Ubuntuvim-motifnoble2:9.1.0016-1ubuntu7.8fixed
Ubuntuvim-noxnoble2:9.1.0016-1ubuntu7.8fixed
Ubuntuvim-runtimenoble2:9.1.0016-1ubuntu7.8fixed
Ubuntuvim-tinynoble2:9.1.0016-1ubuntu7.8fixed
Ubuntuxxdnoble2:9.1.0016-1ubuntu7.8fixed
Alpinevim3.229.1.1164-r0fixed
Alpinevim3.239.1.1164-r0fixed
Ubuntuvimpro2:8.0.0197-4ubuntu5vulnerable
Ubuntuvimpro2:8.0.1144-1ubuntu1vulnerable
Ubuntuvimpro2:8.0.1401-1ubuntu1vulnerable
Ubuntuvimpro2:8.0.1401-1ubuntu2vulnerable
Ubuntuvimpro2:8.0.1401-1ubuntu3vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.1vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.3vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.4vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.6vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.7vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.8vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.9vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.10vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.11vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.12vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13+esm1vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13+esm3vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13+esm4vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13+esm5vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13+esm6vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13+esm7vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13+esm8vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13+esm9vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13+esm10vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13+esm11vulnerable
Ubuntuvimpro2:8.0.1453-1ubuntu1.13+esm12fixed
Ubuntuvim20.042:8.1.0875-5ubuntu2vulnerable
Ubuntuvim20.042:8.1.0875-5ubuntu3vulnerable
Ubuntuvim20.042:8.1.0875-5ubuntu4vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu1vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu4vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.3vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.4vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.6vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.7vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.8vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.9vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.11vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.12vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.13vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.14vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.15vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.16vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.17vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.18vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.20vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.21vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.22vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.23vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.24vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.25vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.26vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.29vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.30vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.31vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.32fixed
Ubuntuvim22.042:8.2.2434-3ubuntu3vulnerable
Ubuntuvim22.042:8.2.2434-3ubuntu4vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu3vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.3vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.4vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.7vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.8vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.9vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.10vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.11vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.12vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.13vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.15vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.16vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.17vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.18vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.19vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.20vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.21vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.22vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.23vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.24fixed
Ubuntuvim24.042:9.0.1672-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2087-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2184-0ubuntu1vulnerable
Ubuntuvim24.042:9.0.2189-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.3vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.4vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.5vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.8fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianvimsourcesid2:9.1.1230-1unimportantNot reportedNot reported
Debianvimsourceforky2:9.1.1230-1unimportantNot reportedNot reported
Debianvimsourcetrixie2:9.1.1230-1unimportantNot reportedNot reported
Debianvimsourcebookworm(unfixed)unimportantNot reportedNot reported
Ubuntuvimdebnoble2:9.1.0016-1ubuntu7.8Not reportedNot reportedNot reported
Ubuntuvim-athenadebnoble2:9.1.0016-1ubuntu7.8Not reportedNot reportedNot reported
Ubuntuvim-commondebnoble2:9.1.0016-1ubuntu7.8Not reportedNot reportedNot reported
Ubuntuvim-docdebnoble2:9.1.0016-1ubuntu7.8Not reportedNot reportedNot reported
Ubuntuvim-gtk3debnoble2:9.1.0016-1ubuntu7.8Not reportedNot reportedNot reported
Ubuntuvim-gui-commondebnoble2:9.1.0016-1ubuntu7.8Not reportedNot reportedNot reported
Ubuntuvim-motifdebnoble2:9.1.0016-1ubuntu7.8Not reportedNot reportedNot reported
Ubuntuvim-noxdebnoble2:9.1.0016-1ubuntu7.8Not reportedNot reportedNot reported
Ubuntuvim-runtimedebnoble2:9.1.0016-1ubuntu7.8Not reportedNot reportedNot reported
Ubuntuvim-tinydebnoble2:9.1.0016-1ubuntu7.8Not reportedNot reportedNot reported
Ubuntuxxddebnoble2:9.1.0016-1ubuntu7.8Not reportedNot reportedNot reported
Alpinevimapk3.229.1.1164-r0Not reportedALPINE-CVE-2025-26603Not reported
Alpinevimapk3.239.1.1164-r0Not reportedALPINE-CVE-2025-26603Not reported
Ubuntuvimdebpro2:8.0.1453-1ubuntu1.13+esm12Not reportedUBUNTU-CVE-2025-26603Not reported
Ubuntuvimdeb20.042:8.1.2269-1ubuntu5.32Not reportedUBUNTU-CVE-2025-26603Not reported
Ubuntuvimdeb22.042:8.2.3995-1ubuntu2.24Not reportedUBUNTU-CVE-2025-26603Not reported
Ubuntuvimdeb24.042:9.1.0016-1ubuntu7.8Not reportedUBUNTU-CVE-2025-26603Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [vim]Affected
    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-tiny]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [xxd]Affected

    Source package: [vim]

    Details (2)

    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

[Debian 13 (Trixie)]

  • [vim]Fixed
    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

  • [vim-athena]Fixed

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

  • [vim-common]Fixed

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

  • [vim-doc]Fixed

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

  • [vim-gtk3]Fixed

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

  • [vim-gui-common]Fixed

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

  • [vim-motif]Fixed

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

  • [vim-nox]Fixed

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · amd64 · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

  • [vim-runtime]Fixed

    Source package: [vim]

    Details (2)

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:9.1.1230-1

      usn · vim · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]