Read the docs
TI-2025-33779 Aliases CVE-2025-53906

Vim has path traversal issue with zip.vim and special crafted zip archives

Priority MEDIUM 52CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 11 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1551 contains a patch for the vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00871 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial vim (vim): 9.1.1551Red Hat: 15 advisoriesRed Hat: 11 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vimvimbefore 9.1.15519.1.1551Patch availableCNA
  • vim Vendorvim Affected before 9.1.1551 Fixed in 9.1.1551 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*before 9.1.1551Vulnerablevim
  • cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* Versions before 9.1.1551 Vulnerable ·vim

Remediation

  • Fix · CNA vim (vim) Fixed in 9.1.1551

Red Hat 15 advisories

  • RHSA-2026:3462 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:3461 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:23080 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
Show 12 more Red Hat advisories
  • RHSA-2025:23079 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23078 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:22868 Released 2025-12-08 · Red Hat rating Important
    Insights proxy Container Image
    • Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
  • RHSA-2025:21994 Released 2025-11-24 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2025:21015 Released 2025-11-11 · Red Hat rating Moderate
    vim security update
    • Red Hat Enterprise Linux AppStream (v. 10) vim-X11-2:9.1.083-6.el10_1, vim-common-2:9.1.083-6.el10_1, vim-enhanced-2:9.1.083-6.el10_1 +1
    • Red Hat Enterprise Linux BaseOS (v. 10) vim-2:9.1.083-6.el10_1, vim-data-2:9.1.083-6.el10_1, vim-filesystem-2:9.1.083-6.el10_1 +1
  • RHSA-2025:20945 Released 2025-11-11 · Red Hat rating Moderate
    vim security update
    • Red Hat Enterprise Linux AppStream (v. 9) vim-X11-2:8.2.2637-23.el9_7, vim-common-2:8.2.2637-23.el9_7, vim-enhanced-2:8.2.2637-23.el9_7
    • Red Hat Enterprise Linux BaseOS (v. 9) vim-2:8.2.2637-23.el9_7, vim-filesystem-2:8.2.2637-23.el9_7, vim-minimal-2:8.2.2637-23.el9_7
  • RHSA-2025:20066 Released 2025-11-10 · Red Hat rating Moderate
    Insights proxy Container Image
    • Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
  • RHSA-2025:19088 Released 2025-10-23 · Red Hat rating Moderate
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2025:17913 Released 2025-10-14 · Red Hat rating Moderate
    vim security update
    • Red Hat Enterprise Linux AppStream (v. 10) vim-X11-2:9.1.083-5.el10_0.1, vim-common-2:9.1.083-5.el10_0.1, vim-enhanced-2:9.1.083-5.el10_0.1 +1
    • Red Hat Enterprise Linux BaseOS (v. 10) vim-2:9.1.083-5.el10_0.1, vim-data-2:9.1.083-5.el10_0.1, vim-filesystem-2:9.1.083-5.el10_0.1 +1
  • RHSA-2025:17742 Released 2025-10-13 · Red Hat rating Moderate
    vim security update
    • Red Hat Enterprise Linux AppStream (v. 9) vim-X11-2:8.2.2637-22.el9_6.1, vim-common-2:8.2.2637-22.el9_6.1, vim-enhanced-2:8.2.2637-22.el9_6.1
    • Red Hat Enterprise Linux BaseOS (v. 9) vim-2:8.2.2637-22.el9_6.1, vim-filesystem-2:8.2.2637-22.el9_6.1, vim-minimal-2:8.2.2637-22.el9_6.1
  • RHSA-2025:17715 Released 2025-10-09 · Red Hat rating Moderate
    vim security update
    • Red Hat Enterprise Linux AppStream (v. 8) vim-X11-2:8.0.1763-21.el8_10, vim-common-2:8.0.1763-21.el8_10, vim-enhanced-2:8.0.1763-21.el8_10 +1
    • Red Hat Enterprise Linux BaseOS (v. 8) vim-2:8.0.1763-21.el8_10, vim-minimal-2:8.0.1763-21.el8_10
  • RHSA-2025:17644 Released 2025-10-09 · Red Hat rating Moderate
    vim security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) vim-X11-2:8.2.2637-20.el9_4.1, vim-common-2:8.2.2637-20.el9_4.1, vim-enhanced-2:8.2.2637-20.el9_4.1
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) vim-2:8.2.2637-20.el9_4.1, vim-filesystem-2:8.2.2637-20.el9_4.1, vim-minimal-2:8.2.2637-20.el9_4.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat AI Inference Server 3.2Fixed RHSA-2025:23078, RHSA-2025:23079, RHSA-2025:23080, RHSA-2026:3461, RHSA-2026:3462
Red Hat Discovery 2Fixed RHSA-2025:19088, RHSA-2025:21994
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:17913, RHSA-2025:21015
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:17715
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:17742, RHSA-2025:20945
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:17644
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:17913, RHSA-2025:21015
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:17715
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:17742, RHSA-2025:20945
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:17644
Red Hat Insights proxy 1.5Fixed RHSA-2025:20066, RHSA-2025:22868
Not affected: 1 product
  • Red Hat Discovery 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53906

References

Exploit 1

Patch 1

  • TI-2022-03248 Heap-based Buffer Overflow in vim/vim CVSS 3.1CRITICAL 9.8
  • TI-2024-15103 Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c… CVSS 3.1HIGH 7.8
  • TI-2023-05093 Use After Free in vim/vim CVSS 3.1HIGH 7.8
  • TI-2023-04407 Heap-based Buffer Overflow in vim/vim CVSS 3.1HIGH 7.8
  • TI-2023-04379 Heap-based Buffer Overflow in vim/vim CVSS 3.1HIGH 7.8
  • TI-2023-04378 Use After Free in vim/vim CVSS 3.1HIGH 7.8
See all 258 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences