VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 25, 2022· Updated Nov 3, 2025

Access of Memory Location Before Start of Buffer in vim/vim

CVE-2022-0351

Description

Vim prior to 8.2.4206 has a buffer underread in expression evaluation leading to crash or memory leak.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Vim prior to 8.2.4206 has a buffer underread in expression evaluation leading to crash or memory leak.

Vulnerability

A buffer underread vulnerability exists in the expression evaluation function eval7 in Vim prior to version 8.2.4206. The bug occurs when deeply nested parentheses cause excessive recursion, leading to a stack overflow and a read from memory before the start of a buffer. This issue was present in all versions before the patched release of Vim 8.2.4206, which was committed on August 11, 2022 [4] and is included in subsequent stable releases.

Exploitation

An attacker can trigger this vulnerability by supplying a specially crafted file containing an expression with many nested parentheses. The victim must open this file in Vim or otherwise cause Vim to evaluate the malicious expression. No special privileges are required; any user who opens a crafted file in Vim or gVim is vulnerable. The crash occurs during parsing, before any execution of arbitrary code, but the underread could potentially expose memory contents.

Impact

Successful exploitation results in a denial-of-service condition due to Vim crashing. Additionally, the underread may disclose sensitive memory from the process, leading to information disclosure. The vulnerability does not directly allow arbitrary code execution, but memory disclosure could aid further attacks. The issue is rated with a CVSS score of 7.8 (high severity) due to the potential for impact on confidentiality and availability.

Mitigation

Vim users should upgrade to version 8.2.4206 or later, released on August 11, 2022 [4]. Distributions such as Gentoo have released an updated package (>=app-editors/vim-9.0.0060) that includes the fix [3]. Apple's security updates for macOS Ventura 13 and Monterey 12.6 also reference this CVE; users should install the latest macOS updates to address the vulnerability [1][2]. No known workarounds exist for unpatched versions.

References
  1. About the security content of macOS Ventura 13 - Apple Support
  2. About the security content of macOS Monterey 12.6 - Apple Support
  3. Multiple Vulnerabilities (GLSA 202208-32) — Gentoo security
  4. patch 8.2.4206: condition with many "(" causes a crash · vim/vim@fe6fb26

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

40

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.