Vim up to 9.1.1405 Vim9 Script Import clear_tv typval_T double free

Summaryinfo

A vulnerability described as critical has been identified in Vim up to 9.1.1405. This affects the function clear_tv of the component Vim9 Script Import. Executing a manipulation of the argument typval_T can lead to double free. This vulnerability is tracked as CVE-2025-55158. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in Vim up to 9.1.1405. This vulnerability affects the function clear_tv of the component Vim9 Script Import. The manipulation of the argument typval_T with an unknown input leads to a double free vulnerability. The CWE definition for the vulnerability is CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1406, when processing nested tuples during Vim9 script import operations, an error during evaluation can trigger a double-free in Vim’s internal typed value (typval_T) management. Specifically, the clear_tv() function may attempt to free memory that has already been deallocated, due to improper lifetime handling in the handle_import / ex_import code paths. The vulnerability can only be triggered if a user explicitly opens and executes a specially crafted Vim script. This issue has been patched in version 9.1.1406.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-55158 since 08/07/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 259917 (Linux Distros Unpatched Vulnerability : CVE-2025-55158), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.1.1406 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 9772025d24e939fd84b85748ce35c26874c05775 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (259917). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Word Processing Software

Name

• Vim

Version

• 9.1.1405

License

• open-source

Website

• Product: https://github.com/vim/vim/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion