CVE-2025-24014

Description

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

• How can I get the fixes?
• What do statuses mean?

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Severity score breakdown

CVSS version: CVSS v3.0

References

• MITRE
• NVD
• Launchpad
• Debian

Related Ubuntu Security Notices (USN)

• USN-7261-1
• Vim vulnerability
• 10 February 2025
• USN-7261-2
• Vim vulnerability
• 1 April 2025
• USN-7815-1
• Vim vulnerabilities
• 9 October 2025

Other references

• https://www.cve.org/CVERecord?id=CVE-2025-24014
• https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955
• https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919
• http://www.openwall.com/lists/oss-security/2025/01/20/4
• http://www.openwall.com/lists/oss-security/2025/01/21/1