CVE-2025-24014

Name	CVE-2025-24014
Description	Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
vim (PTS)	bullseye	2:8.2.2434-3+deb11u1	vulnerable
	bookworm	2:9.0.1378-2	vulnerable
	sid, trixie	2:9.1.0967-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
vim	source	(unstable)	(unfixed)	unimportant

Notes

Crash in CLI tool, no security impact
https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955
Fixed by: https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919 (v9.1.1043)