CVE-2025-9390

A vulnerability was found in the xxd component of Vim in the main function of src/xxd/xxd.c. This flaw allows a local attacker to trigger a buffer overflow, which leads to a denial of service.

This vulnerability is marked MODERATE for a few reasons: first, because it's effect is localized within a victim's system. second, the buffer overflow is caught by compiler-level protection mechanisms before it can cause memory corruption, but represents a genuine security vulnerability that could be exploited in unprotected builds. The vulnerability is detected by GCC's fortify source protection mechanism and occurs when xxd processes input files with binary output (-b) and EBCDIC encoding (-E) flags, leading to buffer overflow conditions that trigger abort signals due to stack protection mechanisms.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to Vim version 9.1.1616 or later to address this issue.