CVE catalog

CVE-2025-53905

Vim vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 4.1CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianvimsid2:9.2.0858-1fixed
Debianvimforky2:9.2.0858-1fixed
Debianvimtrixie2:9.1.1230-2vulnerable
Debianvimbookworm2:9.0.1378-2+deb12u2vulnerable
UbuntuvimnobleNot reportedvulnerable
Ubuntuvimnoble2:9.1.0016-1ubuntu7.9fixed
Ubuntuvim-athenanoble2:9.1.0016-1ubuntu7.9fixed
Ubuntuvim-commonnoble2:9.1.0016-1ubuntu7.9fixed
Ubuntuvim-docnoble2:9.1.0016-1ubuntu7.9fixed
Ubuntuvim-gtk3noble2:9.1.0016-1ubuntu7.9fixed
Ubuntuvim-gui-commonnoble2:9.1.0016-1ubuntu7.9fixed
Ubuntuvim-motifnoble2:9.1.0016-1ubuntu7.9fixed
Ubuntuvim-noxnoble2:9.1.0016-1ubuntu7.9fixed
Ubuntuvim-runtimenoble2:9.1.0016-1ubuntu7.9fixed
Ubuntuvim-tinynoble2:9.1.0016-1ubuntu7.9fixed
Ubuntuxxdnoble2:9.1.0016-1ubuntu7.9fixed
Ubuntuvimpro2:8.1.0875-5ubuntu2vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu3vulnerable
Ubuntuvimpro2:8.1.0875-5ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu1vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.3vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.6vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.7vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.8vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.9vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.11vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.12vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.13vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.14vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.15vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.16vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.17vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.18vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.20vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.21vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.22vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.23vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.24vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.25vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.26vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.29vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.30vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.31vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm2vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm3vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm4vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm5vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm6vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm7vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm8vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm9vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm10vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm12vulnerable
Ubuntuvimpro2:8.1.2269-1ubuntu5.32+esm13vulnerable
Ubuntuvim22.042:8.2.2434-3ubuntu3vulnerable
Ubuntuvim22.042:8.2.2434-3ubuntu4vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu3vulnerable
Ubuntuvim22.042:8.2.3565-1ubuntu5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.1vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.3vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.4vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.5vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.7vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.8vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.9vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.10vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.11vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.12vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.13vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.15vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.16vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.17vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.18vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.19vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.20vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.21vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.22vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.23vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.24vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.26vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.27vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.28vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.29vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.30vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.31vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.32vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.33vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.34vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.35vulnerable
Ubuntuvim22.042:8.2.3995-1ubuntu2.36vulnerable
Ubuntuvim24.042:9.0.1672-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2087-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2184-0ubuntu1vulnerable
Ubuntuvim24.042:9.0.2189-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.3vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.4vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.5vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.8vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.9fixed
Susevimlinux micro 6.09.1.1629-1.1fixed
Susevimlinux micro 6.19.1.1629-slfo.1.1_1.1fixed
Ubuntuvim24.042:9.0.1672-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2087-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu1vulnerable
Ubuntuvim24.042:9.0.2116-1ubuntu2vulnerable
Ubuntuvim24.042:9.0.2184-0ubuntu1vulnerable
Ubuntuvim24.042:9.0.2189-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0-1ubuntu1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.1vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.2vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.3vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.4vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.5vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.6vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.7vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.8vulnerable
Ubuntuvim24.042:9.1.0016-1ubuntu7.9fixed
Susevimlinux enterprise micro 5.59.1.1629-150500.20.33.1fixed
Susevimlinux enterprise module for basesystem 15 sp69.1.1629-150500.20.33.1fixed
Susevimlinux enterprise module for basesystem 15 sp79.1.1629-150500.20.33.1fixed
Susevimlinux enterprise module for desktop applications 15 sp69.1.1629-150500.20.33.1fixed
Susevimlinux enterprise module for desktop applications 15 sp79.1.1629-150500.20.33.1fixed
Opensusevimleap 15.69.1.1629-150500.20.33.1fixed
Susevimlinux enterprise server ltss extended security 12 sp59.1.1629-17.51.1fixed
Susevimlinux enterprise micro 5.39.1.1629-150000.5.78.1fixed
Susevimlinux enterprise micro 5.49.1.1629-150000.5.78.1fixed
Susevimlinux enterprise micro 5.19.1.1629-150000.5.78.1fixed
Susevimlinux enterprise micro 5.29.1.1629-150000.5.78.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianvimsourcesid2:9.1.1829-1not yet assignedNot reported[1109374]
Debianvimsourceforky2:9.1.1829-1not yet assignedNot reported[1109374]
Debianvimsourcetrixie(unfixed)not yet assignedNot reported[1109374]
Debianvimsourcebookworm(unfixed)not yet assignedNot reported[1109374]
Ubuntuvimdebnoble2:9.1.0016-1ubuntu7.9Not reportedNot reportedNot reported
Ubuntuvim-athenadebnoble2:9.1.0016-1ubuntu7.9Not reportedNot reportedNot reported
Ubuntuvim-commondebnoble2:9.1.0016-1ubuntu7.9Not reportedNot reportedNot reported
Ubuntuvim-docdebnoble2:9.1.0016-1ubuntu7.9Not reportedNot reportedNot reported
Ubuntuvim-gtk3debnoble2:9.1.0016-1ubuntu7.9Not reportedNot reportedNot reported
Ubuntuvim-gui-commondebnoble2:9.1.0016-1ubuntu7.9Not reportedNot reportedNot reported
Ubuntuvim-motifdebnoble2:9.1.0016-1ubuntu7.9Not reportedNot reportedNot reported
Ubuntuvim-noxdebnoble2:9.1.0016-1ubuntu7.9Not reportedNot reportedNot reported
Ubuntuvim-runtimedebnoble2:9.1.0016-1ubuntu7.9Not reportedNot reportedNot reported
Ubuntuvim-tinydebnoble2:9.1.0016-1ubuntu7.9Not reportedNot reportedNot reported
Ubuntuxxddebnoble2:9.1.0016-1ubuntu7.9Not reportedNot reportedNot reported
Ubuntuvimdeb24.042:9.1.0016-1ubuntu7.9Not reportedUBUNTU-CVE-2025-53905Not reported
Susevimrpmlinux micro 6.09.1.1629-1.1Not reportedSUSE-SU-2025:20696-1Not reported
Susevimrpmlinux micro 6.19.1.1629-slfo.1.1_1.1Not reportedSUSE-SU-2025:20857-1Not reported
Ubuntuvimdeb24.042:9.1.0016-1ubuntu7.9Not reportedUSN-7748-1Not reported
Susevimrpmlinux enterprise micro 5.59.1.1629-150500.20.33.1Not reportedSUSE-SU-2025:03300-1Not reported
Susevimrpmlinux enterprise module for basesystem 15 sp69.1.1629-150500.20.33.1Not reportedSUSE-SU-2025:03300-1Not reported
Susevimrpmlinux enterprise module for basesystem 15 sp79.1.1629-150500.20.33.1Not reportedSUSE-SU-2025:03300-1Not reported
Susevimrpmlinux enterprise module for desktop applications 15 sp69.1.1629-150500.20.33.1Not reportedSUSE-SU-2025:03300-1Not reported
Susevimrpmlinux enterprise module for desktop applications 15 sp79.1.1629-150500.20.33.1Not reportedSUSE-SU-2025:03300-1Not reported
Opensusevimrpmleap 15.69.1.1629-150500.20.33.1Not reportedSUSE-SU-2025:03300-1Not reported
Susevimrpmlinux enterprise server ltss extended security 12 sp59.1.1629-17.51.1Not reportedSUSE-SU-2025:03299-1Not reported
Susevimrpmlinux enterprise micro 5.39.1.1629-150000.5.78.1Not reportedSUSE-SU-2025:03240-1Not reported
Susevimrpmlinux enterprise micro 5.49.1.1629-150000.5.78.1Not reportedSUSE-SU-2025:03240-1Not reported
Susevimrpmlinux enterprise micro 5.19.1.1629-150000.5.78.1Not reportedSUSE-SU-2025:03240-1Not reported
Susevimrpmlinux enterprise micro 5.29.1.1629-150000.5.78.1Not reportedSUSE-SU-2025:03240-1Not reported

[Debian bug #1109374]

Notes

[trixie] vim: Minor issue [bookworm] vim: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [vim]Affected
    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-common]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [vim-tiny]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

  • [xxd]Affected

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Affected

      usn · vim · debian · bookworm; usn · vim · debian · 12

[Debian 13 (Trixie)]

  • [vim]Affected
    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      usn · vim · debian · 13

  • [vim-athena]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

  • [vim-common]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

  • [vim-doc]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

  • [vim-gtk3]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      usn · vim · debian · 13

  • [vim-gui-common]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

  • [vim-motif]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      usn · vim · debian · 13

  • [vim-nox]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Affected

      usn · vim · debian · 13

  • [vim-runtime]Affected

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Affected

      usn · vim · debian · 13

Next results

Observed:

References