Vulnerability · Published Aug 11, 2025 · Assigned by GitHub_M

CVE-2025-55158Vim double-free vulnerability during Vim9 script import operations

Medium 6.9

In plain English

A medium-severity double free in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 65.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1406, when processing nested tuples during Vim9 script import operations, an error during evaluation can trigger a double-free in Vim’s internal typed value (typval_T) management. Specifically, the clear_tv() function may attempt to free memory that has already been deallocated, due to improper lifetime handling in the handle_import / ex_import code paths. The vulnerability can only be triggered if a user explicitly opens and executes a specially crafted Vim script. This issue has been patched in version 9.1.1406.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	vim	no fix listed	UBUNTU-CVE-2025-55158
Ubuntu:24.04:LTS	vim	no fix listed	UBUNTU-CVE-2025-55158

Affected products (as reported)

Vendor	Product	Versions
vim	vim	>= 9.1.1231, < 9.1.1406

Weakness: CWE-415 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/vim/vim/security/advisories/GHSA-5fg8-wvx3-583x x_refsource_CONFIRM
https://github.com/vim/vim/commit/9772025d24e939fd84b85748ce35c26874c05775 x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.1.1406 x_refsource_MISC