CVE-2025-55158

Name	CVE-2025-55158
Description	Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1406, when processing nested tuples during Vim9 script import operations, an error during evaluation can trigger a double-free in Vim’s internal typed value (typval_T) management. Specifically, the clear_tv() function may attempt to free memory that has already been deallocated, due to improper lifetime handling in the handle_import / ex_import code paths. The vulnerability can only be triggered if a user explicitly opens and executes a specially crafted Vim script. This issue has been patched in version 9.1.1406.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
vim (PTS)	bullseye	2:8.2.2434-3+deb11u1	fixed
	bullseye (security)	2:8.2.2434-3+deb11u3	fixed
	bookworm	2:9.0.1378-2+deb12u2	fixed
	forky, sid, trixie	2:9.1.1230-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
vim	source	(unstable)	(not affected)

Notes

- vim <not-affected> (Vulnerable code introduced later)
https://github.com/vim/vim/security/advisories/GHSA-5fg8-wvx3-583x
Introduced with: https://github.com/vim/vim/commit/9cb865e95bba333fa7b47c39c2729c125b911e36 (v9.1.1232)
Fixed by: https://github.com/vim/vim/commit/9772025d24e939fd84b85748ce35c26874c05775 (v9.1.1406)