← Vulnerability feed

Vulnerability record · CVE-2025-1215 · published 12 February 2025

CVE-2025-1215: Vim memory buffer overflow vulnerability

Vim · Vim

A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.

2.4 CVSS 4.0 Low EPSS 0.54% · top 56.7% CWE-119 · Memory buffer overflow
2.4CVSS 4.0 base score, v2 1.7
0.54%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
9References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/vim/vim/commit/c5654b84480822817bb7b69ebc97c174c91185e9 Patch
https://github.com/vim/vim/issues/16606 ExploitIssue Tracking
https://github.com/vim/vim/releases/tag/v9.1.1097 Release Notes
https://vuldb.com/?ctiid.295174 Permissions RequiredVDB Entry
https://vuldb.com/?id.295174 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.497546 Third Party AdvisoryVDB Entry
https://security.netapp.com/advisory/ntap-20250321-0005/ Third Party Advisory
https://github.com/vim/vim/issues/16606 ExploitIssue Tracking
https://vuldb.com/?submit.497546 Third Party AdvisoryVDB Entry

Track CVE-2025-1215 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-24813Apache Tomcat Default Servlet path equivalence enables RCE and file disclosureApache Tomcat mishandles path equivalence for names containing an internal dot, letting a remote unauthenticated attacker write files through the Def…KEVEPSS 100%analysed7.8CVE-2024-1086Linux kernel nf_tables use-after-free allows local privilege escalationThe Linux kernel's netfilter nf_tables component has a use-after-free in nft_verdict_init(), where positive drop errors are accepted and nf_hook_slow…KEVEPSS 28%analysed7.8CVE-2023-4911GNU C Library ld.so GLIBC_TUNABLES heap buffer overflowThe GNU C Library dynamic loader ld.so mishandles the GLIBC_TUNABLES environment variable, causing a heap-based buffer overflow and out-of-bounds wri…KEVEPSS 81%analysed7.8CVE-2022-0492Linux kernel cgroups v1 release_agent privilege escalation and container escapeThe Linux kernel's cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c mishandles authorization, letting the cgroups v1 release_agent feature be …KEVEPSS 5.5%analysed9.8CVE-2024-56337Apache tomcat toctou race condition vulnerabilityTime-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, fr…EPSS 9.0%9.8CVE-2024-50379Apache tomcat toctou race condition vulnerabilityTime-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file syste…EPSS 32%9.8CVE-2020-20703Vim classic buffer overflow vulnerabilityBuffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter.EPSS 1.5%9.8CVE-2022-3520Vim heap-based buffer overflow vulnerabilityHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2025-1215), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.