CVE-2025-9389 (GCVE-0-2025-9389)
Vulnerability from cvelistv5
Published
2025-08-24 13:02
Modified
2025-08-25 18:31
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-119 - Memory Corruption
Summary
A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, "when coloring is turned on".
References
▼ | URL | Tags | |
---|---|---|---|
cna@vuldb.com | https://drive.google.com/file/d/1iFbTpW79vqBPkFjWYzGYIh_E6esPhYVY/view?usp=sharing | Exploit | |
cna@vuldb.com | https://github.com/vim/vim/issues/17940 | Exploit, Issue Tracking, Patch, Vendor Advisory | |
cna@vuldb.com | https://github.com/vim/vim/issues/17940#issuecomment-3203415781 | Exploit, Issue Tracking, Patch | |
cna@vuldb.com | https://vuldb.com/?ctiid.321222 | Permissions Required, VDB Entry | |
cna@vuldb.com | https://vuldb.com/?id.321222 | Third Party Advisory, VDB Entry | |
cna@vuldb.com | https://vuldb.com/?submit.630898 | Exploit, Third Party Advisory, VDB Entry | |
134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://github.com/vim/vim/issues/17940 | Exploit, Issue Tracking, Patch, Vendor Advisory | |
134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://github.com/vim/vim/issues/17940#issuecomment-3203415781 | Exploit, Issue Tracking, Patch | |
134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://vuldb.com/?submit.630898 | Exploit, Third Party Advisory, VDB Entry |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2025-9389", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-08-25T18:31:24.208493Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-08-25T18:31:29.738Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "references": [ { "tags": [ "exploit" ], "url": "https://vuldb.com/?submit.630898" }, { "tags": [ "exploit" ], "url": "https://github.com/vim/vim/issues/17940" }, { "tags": [ "exploit" ], "url": "https://github.com/vim/vim/issues/17940#issuecomment-3203415781" } ], "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "vim", "vendor": "n/a", "versions": [ { "status": "affected", "version": "9.1.0000" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Xudong Cao" }, { "lang": "en", "type": "finder", "value": "Meng Xu" } ], "descriptions": [ { "lang": "en", "value": "A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, \"when coloring is turned on\"." }, { "lang": "de", "value": "In vim 9.1.0000 wurde eine Schwachstelle gefunden. Es geht dabei um die Funktion __memmove_avx_unaligned_erms der Datei memmove-vec-unaligned-erms.S. Mittels Manipulieren mit unbekannten Daten kann eine memory corruption-Schwachstelle ausgenutzt werden. Der Angriff ist nur lokal m\u00f6glich. Die Schwachstelle wurde \u00f6ffentlich offengelegt und k\u00f6nnte ausgenutzt werden." } ], "metrics": [ { "cvssV4_0": { "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "version": "4.0" } }, { "cvssV3_1": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-119", "description": "Memory Corruption", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-08-24T13:02:07.721Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "name": "VDB-321222 | vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption", "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.321222" }, { "name": "VDB-321222 | CTI Indicators (IOB, IOC, IOA)", "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.321222" }, { "name": "Submit #630898 | vim xxd vim-9.1.0000 and related xxd versions (latest master branch) Memory Corruption", "tags": [ "third-party-advisory" ], "url": "https://vuldb.com/?submit.630898" }, { "tags": [ "issue-tracking" ], "url": "https://github.com/vim/vim/issues/17940" }, { "tags": [ "issue-tracking" ], "url": "https://github.com/vim/vim/issues/17940#issuecomment-3203415781" }, { "tags": [ "exploit" ], "url": "https://drive.google.com/file/d/1iFbTpW79vqBPkFjWYzGYIh_E6esPhYVY/view?usp=sharing" } ], "timeline": [ { "lang": "en", "time": "2025-08-23T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2025-08-23T02:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2025-08-23T17:29:11.000Z", "value": "VulDB entry last update" } ], "title": "vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2025-9389", "datePublished": "2025-08-24T13:02:07.721Z", "dateReserved": "2025-08-23T15:24:08.413Z", "dateUpdated": "2025-08-25T18:31:29.738Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2025-9389\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2025-08-24T13:15:29.680\",\"lastModified\":\"2025-09-12T18:38:34.803\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, \\\"when coloring is turned on\\\".\"},{\"lang\":\"es\",\"value\":\"Se identific\u00f3 una vulnerabilidad en vim 9.1.0000. La funci\u00f3n __memmove_avx_unaligned_erms del archivo memmove-vec-unaligned-erms.S est\u00e1 afectada. La manipulaci\u00f3n provoca corrupci\u00f3n de memoria. El ataque debe ejecutarse localmente. Se ha hecho p\u00fablico el exploit y puede que sea utilizado. Algunos usuarios no pueden reproducirlo. Uno de ellos menciona que esto parece no funcionar cuando el coloreado est\u00e1 activado.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:S/C:N/I:N/A:P\",\"baseScore\":1.7,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.1,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:9.1.0000:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0E1FD0DD-B47A-45A3-8045-EC2FD430ACAC\"}]}]}],\"references\":[{\"url\":\"https://drive.google.com/file/d/1iFbTpW79vqBPkFjWYzGYIh_E6esPhYVY/view?usp=sharing\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Exploit\"]},{\"url\":\"https://github.com/vim/vim/issues/17940\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/vim/vim/issues/17940#issuecomment-3203415781\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://vuldb.com/?ctiid.321222\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Permissions Required\",\"VDB Entry\"]},{\"url\":\"https://vuldb.com/?id.321222\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://vuldb.com/?submit.630898\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://github.com/vim/vim/issues/17940\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/vim/vim/issues/17940#issuecomment-3203415781\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://vuldb.com/?submit.630898\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]}]}}", "vulnrichment": { "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-9389\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-25T18:31:24.208493Z\"}}}], \"references\": [{\"url\": \"https://vuldb.com/?submit.630898\", \"tags\": [\"exploit\"]}, {\"url\": \"https://github.com/vim/vim/issues/17940\", \"tags\": [\"exploit\"]}, {\"url\": \"https://github.com/vim/vim/issues/17940#issuecomment-3203415781\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-25T18:31:14.297Z\"}}], \"cna\": {\"title\": \"vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Xudong Cao\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Meng Xu\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 4.8, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 3.3, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 3.3, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 1.7, \"vectorString\": \"AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C\"}}], \"affected\": [{\"vendor\": \"n/a\", \"product\": \"vim\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.1.0000\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-08-23T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2025-08-23T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2025-08-23T17:29:11.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/?id.321222\", \"name\": \"VDB-321222 | vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/?ctiid.321222\", \"name\": \"VDB-321222 | CTI Indicators (IOB, IOC, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/?submit.630898\", \"name\": \"Submit #630898 | vim xxd vim-9.1.0000 and related xxd versions (latest master branch) Memory Corruption\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/vim/vim/issues/17940\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://github.com/vim/vim/issues/17940#issuecomment-3203415781\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://drive.google.com/file/d/1iFbTpW79vqBPkFjWYzGYIh_E6esPhYVY/view?usp=sharing\", \"tags\": [\"exploit\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, \\\"when coloring is turned on\\\".\"}, {\"lang\": \"de\", \"value\": \"In vim 9.1.0000 wurde eine Schwachstelle gefunden. Es geht dabei um die Funktion __memmove_avx_unaligned_erms der Datei memmove-vec-unaligned-erms.S. Mittels Manipulieren mit unbekannten Daten kann eine memory corruption-Schwachstelle ausgenutzt werden. Der Angriff ist nur lokal m\\u00f6glich. Die Schwachstelle wurde \\u00f6ffentlich offengelegt und k\\u00f6nnte ausgenutzt werden.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-119\", \"description\": \"Memory Corruption\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2025-08-24T13:02:07.721Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2025-9389\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-25T18:31:29.738Z\", \"dateReserved\": \"2025-08-23T15:24:08.413Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2025-08-24T13:02:07.721Z\", \"assignerShortName\": \"VulDB\"}", "dataType": "CVE_RECORD", "dataVersion": "5.1" } } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…