vim/vim vulnerabilities

8 known vulnerabilities in vim/vim from Vim. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  vim/vim: Out-of-bounds Write

  CVE-2022-4141Nov 25, 2022Vim

  Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.

• 7.8 High severity

  vim/vim: Out-of-bounds Read

  CVE-2022-1720Jun 20, 2022VimEPSS 2.18%

  Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.

• 7.8 High severity

  vim/vim: Out-of-bounds Read

  CVE-2022-1629May 10, 2022VimEPSS 1.91%

  Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution

• 7.8 High severity

  vim/vim: Out-of-bounds Write

  CVE-2022-1621May 10, 2022VimEPSS 2.38%

  Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

• 7.5 High severity

  vim/vim: NULL Pointer Dereference

  CVE-2022-1620May 8, 2022VimEPSS 1.61%

  NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash)

• 7.8 High severity

  vim/vim: Out-of-bounds Write

  CVE-2022-1619May 8, 2022VimEPSS 2.56%

  Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution

• 7.8 High severity

  vim/vim: Use After Free

  CVE-2022-1616May 7, 2022VimEPSS 2.73%

  Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

• 7.8 High severity

  vim/vim: Out-of-bounds Write

  CVE-2022-1381Apr 18, 2022VimEPSS 3.08%

  global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution