A memory corruption vulnerability in the Vim text editor allows an attacker to cause a crash by enticing a user to execute a specifically crafted Vim script.

The vulnerability is a double-free flaw (CWE-415) occurring within the internal typed value management system. It is triggered during Vim9 script import operations, specifically when an error occurs during the evaluation of nested tuples, requiring user interaction to execute the malicious script.

This vulnerability carries a CVSS score of 8.8, indicating a high severity due to the potential for application instability and service disruption. While the impact is primarily limited to a crash (availability loss), successful exploitation could lead to local denial of service for users relying on Vim for critical development or administrative tasks.

Immediate Action: Update the Vim installation to version 9.1.1406 or later to incorporate the corrected memory management logic.

Proactive Monitoring: Monitor system logs for unexpected application crashes or segmentation faults occurring during script execution or import operations.

Compensating Controls: Exercise caution when opening untrusted or externally sourced Vim scripts, as execution of such files is the primary vector for triggering this flaw.

Public Exploit Available: Unknown

Organizations and individual developers should prioritize updating their Vim instances to version 9.1.1406 to eliminate this memory safety issue. Administrators should ensure that internal security policies restrict the execution of untrusted scripts to prevent the accidental triggering of this vulnerability.