#VU105169 Input validation error in Vim - CVE-2025-27423
Vulnerability identifier: #VU105169
Vulnerability risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2025-27423
CWE-ID:
CWE-20
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Vim
Client/Desktop applications /
Software for system administration
Vendor: Vim.org
Description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input within the tar.vim plugin. A remote attacker can trick the victim to open a specially crafted tar file and execute arbitrary code on the system.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Vim: 9.1.0858, 9.1.0859, 9.1.0860, 9.1.0861, 9.1.0862, 9.1.0863, 9.1.0864, 9.1.0865, 9.1.0866, 9.1.0867, 9.1.0868, 9.1.0869, 9.1.0870, 9.1.0871, 9.1.0872, 9.1.0873, 9.1.0874, 9.1.0875, 9.1.0876, 9.1.0877, 9.1.0878, 9.1.0879, 9.1.0880, 9.1.0881, 9.1.0882, 9.1.0883, 9.1.0884, 9.1.0885, 9.1.0886, 9.1.0887, 9.1.0888, 9.1.0889, 9.1.0890, 9.1.0891, 9.1.0892, 9.1.0893, 9.1.0894, 9.1.0895, 9.1.0896, 9.1.0897, 9.1.0898, 9.1.0899, 9.1.0900, 9.1.0901, 9.1.0902, 9.1.0903, 9.1.0904, 9.1.0905, 9.1.0906, 9.1.0907, 9.1.0908, 9.1.0909, 9.1.0910, 9.1.0911, 9.1.0912, 9.1.0913, 9.1.0914, 9.1.0915, 9.1.0916, 9.1.0917, 9.1.0918, 9.1.0919, 9.1.0920, 9.1.0921, 9.1.0922, 9.1.0923, 9.1.0924, 9.1.0925, 9.1.0926, 9.1.0927, 9.1.0928, 9.1.0929, 9.1.0930, 9.1.0931, 9.1.0932, 9.1.0933, 9.1.0934, 9.1.0935, 9.1.0936, 9.1.0937, 9.1.0938, 9.1.0939, 9.1.0940, 9.1.0941, 9.1.0942, 9.1.0943, 9.1.0944, 9.1.0945, 9.1.0946, 9.1.0947, 9.1.0948, 9.1.0949, 9.1.0950, 9.1.0951, 9.1.0952, 9.1.0953, 9.1.0954, 9.1.0955, 9.1.0956, 9.1.0957, 9.1.0958, 9.1.0959, 9.1.0960, 9.1.0961, 9.1.0962, 9.1.0963, 9.1.0964, 9.1.0965, 9.1.0966, 9.1.0967, 9.1.0968, 9.1.0969, 9.1.0970, 9.1.0971, 9.1.0972, 9.1.0973, 9.1.0974, 9.1.0975, 9.1.0976, 9.1.0977, 9.1.0978, 9.1.0979, 9.1.0980, 9.1.0981, 9.1.0982, 9.1.0983, 9.1.0984, 9.1.0985, 9.1.0986, 9.1.0987, 9.1.0988, 9.1.0989, 9.1.0990, 9.1.0991, 9.1.0992, 9.1.0993, 9.1.0994, 9.1.0995, 9.1.0996, 9.1.0997, 9.1.0998, 9.1.0999, 9.1.1000, 9.1.1001, 9.1.1002, 9.1.1003, 9.1.1004, 9.1.1005, 9.1.1006, 9.1.1007, 9.1.1008, 9.1.1009, 9.1.1010, 9.1.1011, 9.1.1012, 9.1.1013, 9.1.1014, 9.1.1015, 9.1.1016, 9.1.1017, 9.1.1018, 9.1.1019, 9.1.1020, 9.1.1021, 9.1.1022, 9.1.1023, 9.1.1024, 9.1.1025, 9.1.1026, 9.1.1027, 9.1.1028, 9.1.1029, 9.1.1030, 9.1.1031, 9.1.1032, 9.1.1033, 9.1.1034, 9.1.1035, 9.1.1036, 9.1.1037, 9.1.1038, 9.1.1039, 9.1.1040, 9.1.1041, 9.1.1042, 9.1.1043, 9.1.1044, 9.1.1045, 9.1.1046, 9.1.1047, 9.1.1048, 9.1.1049, 9.1.1050, 9.1.1051, 9.1.1052, 9.1.1053, 9.1.1054, 9.1.1055, 9.1.1056, 9.1.1057, 9.1.1058, 9.1.1059, 9.1.1060, 9.1.1061, 9.1.1062, 9.1.1063, 9.1.1064, 9.1.1065, 9.1.1066, 9.1.1067, 9.1.1068, 9.1.1069, 9.1.1070, 9.1.1071, 9.1.1072, 9.1.1073, 9.1.1074, 9.1.1075, 9.1.1076, 9.1.1077, 9.1.1078, 9.1.1079, 9.1.1080, 9.1.1081, 9.1.1082, 9.1.1083, 9.1.1084, 9.1.1085, 9.1.1086, 9.1.1087, 9.1.1088, 9.1.1089, 9.1.1090, 9.1.1091, 9.1.1092, 9.1.1093, 9.1.1094, 9.1.1095, 9.1.1096, 9.1.1097, 9.1.1098, 9.1.1099, 9.1.1100, 9.1.1101, 9.1.1102, 9.1.1103, 9.1.1104, 9.1.1105, 9.1.1106, 9.1.1107, 9.1.1108, 9.1.1109, 9.1.1110, 9.1.1111, 9.1.1112, 9.1.1113, 9.1.1114, 9.1.1115, 9.1.1116, 9.1.1117, 9.1.1118, 9.1.1119, 9.1.1120, 9.1.1121, 9.1.1122, 9.1.1123, 9.1.1124, 9.1.1125, 9.1.1126, 9.1.1127, 9.1.1128, 9.1.1129, 9.1.1130, 9.1.1131, 9.1.1132, 9.1.1133, 9.1.1134, 9.1.1135, 9.1.1136, 9.1.1137, 9.1.1138, 9.1.1139, 9.1.1140, 9.1.1141, 9.1.1142, 9.1.1143, 9.1.1144, 9.1.1145, 9.1.1146, 9.1.1147, 9.1.1148, 9.1.1149, 9.1.1150, 9.1.1151, 9.1.1152, 9.1.1153, 9.1.1154, 9.1.1155, 9.1.1156, 9.1.1157, 9.1.1158, 9.1.1159, 9.1.1160, 9.1.1161, 9.1.1162, 9.1.1163
External links
https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3
https://github.com/vim/vim/commit/334a13bff78aa0ad206bc436885f63e3a0bab399
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
