CVE-2025-9389 vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption
Local attackers can exploit memory corruption in Vim's assembly code to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9389?
CVE-2025-9389 is a medium-severity memory corruption vulnerability in Vim Vim, published on 24 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, "when coloring is turned on".
Which versions are affected by CVE-2025-9389?
It affects 1 product.
Products include Vim Vim.
How do I fix CVE-2025-9389?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-9389 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-9389 exists.
Other vulnerabilities in Vim Vim
Sources
Also known as BELL-CVE-2025-9389, GHSA-p222-mxxm-v36m.