CVE-2025-26603 heap-use-after-free in function str_to_reg in vim/vim
A use-after-free vulnerability in Vim allows attackers to execute arbitrary code or cause a crash by redirecting display output to specific clipboard registers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-26603?
CVE-2025-26603 is a medium-severity use after free vulnerability in Netapp Hci Compute Node, published on 18 Feb 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-416
Which versions are affected by CVE-2025-26603?
It affects 2 products.
Products include Netapp Hci Compute Node, Vim Vim.
How do I fix CVE-2025-26603?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-26603 being exploited?
There is no known exploitation of CVE-2025-26603 in the wild and no public exploit code.
Other vulnerabilities in Netapp Hci Compute Node
Sources
Also known as ALPINE-CVE-2025-26603, AZL-56913, AZL-56962, BELL-CVE-2025-26603, CLSA-2025-1756928197, DEBIAN-CVE-2025-26603 and 4 more.