CVE-2026-25749 vim CVE debrief

Who should care

System administrators managing multi-user environments with Vim installations, developers using Vim or Neovim in CI/CD pipelines, security teams tracking editor-related attack surfaces, and Neovim users awaiting a corresponding security update

Technical summary

The vulnerability stems from an unsafe STRCPY() operation in Vim's get_tagfname() function (src/tag.c) that copies the user-controlled 'helpfile' option into a fixed-size heap buffer of MAXPATHL + 1 bytes without length validation. An attacker who can control the 'helpfile' option value—through configuration files or command-line arguments—can supply a path exceeding the buffer size, triggering a heap buffer overflow. The overflow can corrupt adjacent heap metadata or data structures, potentially leading to denial of service (application crash) or integrity degradation. The attack requires local access and user interaction (e.g., opening a crafted file or running Vim with malicious configuration), with low privileges. The confidentiality impact is none per CVSS, but integrity and availability impacts are rated high. The fix in version 9.1.2132 replaces the unsafe copy with bounds-checked operations.

Defensive priority

medium

Recommended defensive actions

• Upgrade Vim to version 9.1.2132 or later to eliminate the vulnerability
• For Neovim users, monitor vendor channels for an updated release addressing this issue
• Restrict untrusted users from modifying Vim configuration files that set the 'helpfile' option
• Review and audit custom Vim configurations for unusually long 'helpfile' path values
• Consider applying the upstream patch commit if immediate upgrading is not feasible
• Deploy application allowlisting and execution controls to limit Vim usage to authorized contexts

Evidence notes

The vulnerability is confirmed through official vendor security advisory and patch commit. The NVD record lists both Vim and Neovim as affected products, with CPE criteria specifying Vim versions before 9.1.2132 and Neovim versions up to 0.11.6. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H, scoring 6.6 (MEDIUM). The weakness is classified as CWE-122 (Heap-based Buffer Overflow).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.