Use-after-free in Vim - CVE-2025-26603

Vulnerability identifier: #VU103998

CSH Severity: High

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-26603

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the str_to_reg() function in src/register.c. A remote attacker can trick the victim into opening a specially crafted file and execute arbitrary code on the system.

Vim
Ubuntu
openEuler
Anolis OS
Fedora
vim (Ubuntu package)
vim-filesystem
vim-enhanced
vim-common
vim-X11
vim-minimal
vim-data
vim-doc
vim-debugsource
vim-debuginfo
vim

Install updates from vendor's website.

Vim - update to 9.1.1115
vim (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.1.2269-1ubuntu5.32, 2:8.2.3995-1ubuntu2.24, 2:9.1.0016-1ubuntu7.8, 2:9.1.0496-1ubuntu6.5
vim-filesystem - update to 9.0.2092-8
vim-enhanced - update to 9.0.2092-8
vim-common - update to 9.0.2092-8
vim-X11 - update to 9.0.2092-8
vim-minimal - update to 9.0.2092-8
vim-data - update to 9.0.2092-8
vim-doc - update to 9.0.2092-8
vim-minimal - update to 9.0.2092-17
vim-filesystem - update to 9.0.2092-17
vim-enhanced - update to 9.0.2092-17
vim-debugsource - update to 9.0.2092-17
vim-debuginfo - update to 9.0.2092-17
vim-common - update to 9.0.2092-17
vim-X11 - update to 9.0.2092-17
vim - update to 9.0.2092-17
vim - addressed in versions 9.1.1122-1.fc40, 9.1.1122-1.fc41, 9.1.1122-1.fc42, 9.1.1169-1.fc42

• https://github.com/vim/vim/security/advisories/GHSA-63p5-mwg2-787v
• https://github.com/vim/vim/commit/c0f0e2380e5954f4a52a131bf6b8

• Use-after-free in Vim
• Fedora 42 update for vim
• Fedora 41 update for vim
• Fedora 40 update for vim
• openEuler update for vim
• Fedora 42 update for vim
• Ubuntu update for vim
• Anolis OS update for vim