vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption
Summary
| CVE | CVE-2025-9389 |
|---|---|
| State | PUBLISHED |
| Assigner | VulDB |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-08-24 13:15:29 UTC |
| Updated | 2026-04-29 01:00:01 UTC |
| Description | A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, "when coloring is turned on". |
Risk And Classification
Primary CVSS: v4.0 1.9 LOW from [email protected]
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-119 | CWE-787 | CWE-119 Memory Corruption
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 1.9 | LOW | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/C... |
| 4.0 | CNA | DECLARED | 4.8 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P |
| 3.1 | [email protected] | Primary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | [email protected] | Secondary | 3.3 | LOW | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| 3.1 | CNA | DECLARED | 3.3 | LOW | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C |
| 3.0 | CNA | DECLARED | 3.3 | LOW | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C |
| 2.0 | [email protected] | Secondary | 1.7 | AV:L/AC:L/Au:S/C:N/I:N/A:P | |
| 2.0 | CNA | DECLARED | 1.7 | AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C |
CVSS v4.0 Breakdown
Attack Vector
LocalAttack Complexity
LowAttack Requirements
NonePrivileges Required
LowUser Interaction
NoneConfidentiality
NoneIntegrity
NoneAvailability
LowSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v3.0 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| drive.google.com/file/d/1iFbTpW79vqBPkFjWYzGYIh_E6esPhYVY/view | [email protected] | drive.google.com | Exploit |
| vuldb.com | [email protected] | vuldb.com | Permissions Required, VDB Entry |
| vuldb.com | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | vuldb.com | Exploit, Third Party Advisory, VDB Entry |
| github.com/vim/vim/issues/17940 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | Exploit, Issue Tracking, Patch, Vendor Advisory |
| github.com/vim/vim/issues/17940 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | Exploit, Issue Tracking, Patch |
| vuldb.com | [email protected] | vuldb.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Xudong Cao (en)
CNA: Meng Xu (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2025-08-23T00:00:00.000Z | Advisory disclosed |
| CNA | 2025-08-23T02:00:00.000Z | VulDB entry created |
| CNA | 2025-08-23T17:29:11.000Z | VulDB entry last update |
There are currently no legacy QID mappings associated with this CVE.