Use-After-Free Vulnerability in Vim Editor by Vim Team

CVE-2025-26603

What is CVE-2025-26603?

Vim suffers from a use-after-free vulnerability due to improper handling of register content when redirecting output using the ':display' command. This flaw occurs when Vim attempts to free the contents of a register that is being displayed simultaneously. The vulnerability particularly affects the handling of the '+'' and '*' registers, which are associated with clipboard functionality. Upgrading to Patch 9.1.1115 is crucial, as it corrects the redirect behavior to prevent misuse of register zero when the clipboard registers are in use. Unfortunately, no workarounds are available, making an immediate update imperative for users.

References