Каталог CVE

CVE-2025-9390

vim affected and fixed versions

A security flaw has been discovered in vim up to 9.1.1615. Affected by this vulnerability is the function main of the file src/xxd/xxd.c of the component xxd. The manipulation results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be exploited. Upgrading to version 9.1.1616 addresses this issue. The patch is identified as eeef7c77436a78cd27047b0f5fa6925d56de3cb0. It is recommended to upgrade the affected component.

Критичність: Medium · CVSS 4.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Published: Aug 24, 2025, 2:02:09 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.28% · Oct 27, 2026

Projects and upstream resources

[vim][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	vim	`2:9.1.1829-1`	FixedDistribution-reported fixed boundary	[CVE-2025-9390]
Debiansid	vim	`2:9.2.0858-1`	Fixed	[CVE-2025-9390]
Debianforky	vim	`2:9.1.1829-1`	FixedDistribution-reported fixed boundary	[CVE-2025-9390]
Debianforky	vim	`2:9.2.0858-1`	Fixed	[CVE-2025-9390]

Showing 4 fix observations. All 9 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	vim	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	vim	Not reported	Not affectedDistribution reports not affected	[CVE-2025-9390]
Debianbookworm	vim	`2:9.0.1378-2+deb12u2`	Not affected	[CVE-2025-9390]
Debianforky	vim	`2:9.1.1829-1`	FixedDistribution-reported fixed boundary	[CVE-2025-9390]
Debianforky	vim	`2:9.2.0858-1`	Fixed	[CVE-2025-9390]
Debiansid	vim	`2:9.1.1829-1`	FixedDistribution-reported fixed boundary	[CVE-2025-9390]
Debiansid	vim	`2:9.2.0858-1`	Fixed	[CVE-2025-9390]
Debiantrixie	vim	Not reported	Not affectedDistribution reports not affected	[CVE-2025-9390]
Debiantrixie	vim	`2:9.1.1230-2`	Not affected	[CVE-2025-9390]

Original provider fields

{
  "package_releases": [
    {
      "name": "vim",
      "status": "fixed",
      "release": "sid",
      "version": "2:9.2.0858-1"
    },
    {
      "name": "vim",
      "status": "fixed",
      "release": "forky",
      "version": "2:9.2.0858-1"
    },
    {
      "name": "vim",
      "status": "not affected",
      "release": "trixie",
      "version": "2:9.1.1230-2"
    },
    {
      "name": "vim",
      "status": "not affected",
      "release": "bookworm",
      "version": "2:9.0.1378-2+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "vim",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "2:9.1.1829-1"
    },
    {
      "bug": null,
      "name": "vim",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "2:9.1.1829-1"
    },
    {
      "bug": null,
      "name": "vim",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "vim",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "vim",
      "fixed_version": "0",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Зіставлення пакетів триває.

[Debian 12 (Bookworm)]

[vim]Невідомо
Подробиці (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm
[vim-athena]Невідомо
Пакет джерела: [vim]
Подробиці (2)
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Не уражена
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Не уражена
  dsa · vim · debian · bookworm
[vim-common]Невідомо
Пакет джерела: [vim]
Подробиці (2)
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Не уражена
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Не уражена
  dsa · vim · debian · bookworm
[vim-doc]Невідомо
Пакет джерела: [vim]
Подробиці (2)
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Не уражена
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Не уражена
  dsa · vim · debian · bookworm
[vim-gtk3]Невідомо
Пакет джерела: [vim]
Подробиці (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm
[vim-gui-common]Невідомо
Пакет джерела: [vim]
Подробиці (2)
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Не уражена
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Не уражена
  dsa · vim · debian · bookworm
[vim-motif]Невідомо
Пакет джерела: [vim]
Подробиці (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm
[vim-nox]Невідомо
Пакет джерела: [vim]
Подробиці (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm
[vim-runtime]Невідомо
Пакет джерела: [vim]
Подробиці (2)
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Не уражена
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · all · bookworm
  Не уражена
  dsa · vim · debian · bookworm
[vim-tiny]Невідомо
Пакет джерела: [vim]
Подробиці (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm
[xxd]Невідомо
Пакет джерела: [vim]
Подробиці (2)
- 2:9.0.1378-2+deb12u2 · amd64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm
- 2:9.0.1378-2+deb12u2 · arm64 · bookworm
  Не уражена
  dsa · vim · debian · bookworm

Спостережено: Oct 24, 2026, 7:23:51 PM UTC

Посилання

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]