CVE-2025-24014

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-24014
Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

5.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2025/01/20/4 Mailing List
http://www.openwall.com/lists/oss-security/2025/01/21/1 Mailing List
https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919 Patch
https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955 Vendor Advisory
https://security.netapp.com/advisory/ntap-20250314-0005/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
History

14 Aug 2025, 01:40

Type Values Removed Values Added
First Time Netapp
Vim
Vim vim
Netapp hci Compute Node Firmware
Netapp hci Compute Node
CPE cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () http://www.openwall.com/lists/oss-security/2025/01/20/4 - () http://www.openwall.com/lists/oss-security/2025/01/20/4 - Mailing List
References () https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955 - () https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955 - Vendor Advisory
References () https://security.netapp.com/advisory/ntap-20250314-0005/ - () https://security.netapp.com/advisory/ntap-20250314-0005/ - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2025/01/21/1 - () http://www.openwall.com/lists/oss-security/2025/01/21/1 - Mailing List
References () https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919 - () https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919 - Patch

14 Mar 2025, 10:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250314-0005/ -

21 Jan 2025, 03:15

Type Values Removed Values Added
CWE CWE-787
References
  • () http://www.openwall.com/lists/oss-security/2025/01/20/4 -
  • () http://www.openwall.com/lists/oss-security/2025/01/21/1 -

20 Jan 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-20 23:15

Updated : 2025-08-14 01:40

NVD link : CVE-2025-24014

Mitre link : CVE-2025-24014

JSON object : View

Products Affected

vim

  • vim

netapp

  • hci_compute_node
  • hci_compute_node_firmware
CWE

No CWE.