A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://github.com/vim/vim/commit/c5654b84480822817bb7b69ebc97c174c91185e9 cve-icon cve-icon cve-icon
https://github.com/vim/vim/issues/16606 cve-icon cve-icon cve-icon cve-icon
https://github.com/vim/vim/releases/tag/v9.1.1097 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-1215 cve-icon
https://vuldb.com/?ctiid.295174 cve-icon cve-icon cve-icon
https://vuldb.com/?id.295174 cve-icon cve-icon cve-icon
https://vuldb.com/?submit.497546 cve-icon cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-1215 cve-icon
History

Thu, 13 Feb 2025 01:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 12 Feb 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Feb 2025 18:45:00 +0000

Type Values Removed Values Added
Description A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.
Title vim main.c memory corruption
Weaknesses CWE-119
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P'}

cvssV3_0

{'score': 2.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L'}

cvssV3_1

{'score': 2.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2025-02-12T19:39:22.660Z

Reserved: 2025-02-10T22:55:47.747Z

Link: CVE-2025-1215

cve-icon Vulnrichment

Updated: 2025-02-12T19:39:13.904Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-02-12T19:15:10.230

Modified: 2025-02-12T20:15:39.773

Link: CVE-2025-1215

cve-icon Redhat

Severity : Low

Publid Date: 2025-02-12T18:31:06Z

Links: CVE-2025-1215 - Bugzilla