VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 26, 2022· Updated Nov 3, 2025

Heap-based Buffer Overflow in vim/vim

CVE-2022-0361

Description

Heap buffer overflow in Vim prior to 8.2 allows arbitrary code execution via a crafted file when copying lines in Visual mode.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Heap buffer overflow in Vim prior to 8.2 allows arbitrary code execution via a crafted file when copying lines in Visual mode.

Vulnerability

A heap-based buffer overflow exists in Vim (and gVim) prior to version 8.2, specifically in the ex_copy function when copying lines while Visual mode is active. The issue was introduced because the code did not properly check the validity of the Visual area after appending lines, potentially allowing the end of the Visual area to extend beyond the end of a line. This affects all versions before the fix identified in GitHub commit dc5490e2cbc8c16022a23b449b48c1bd0083f366 (patch 8.2.4215) [3].

Exploitation

An attacker can trigger the overflow by convincing a user to open a specially crafted file with Vim and then perform a specific sequence of operations: moving the cursor to a target line, entering Visual mode, and copying lines (:copy or related command). The attacker does not need authenticated access, but the victim must open the malicious file and execute the steps. No special network position is required if the file is delivered locally or via email/web [3].

Impact

Successful exploitation of this heap-based buffer overflow can lead to arbitrary code execution in the context of the Vim process. An attacker could potentially achieve denial of service (crash) or complete compromise of the user's system, depending on how Vim is invoked. Mac systems that included an affected Vim version (e.g., macOS Ventura 13, macOS Monterey 12.6) list the impact as arbitrary code execution [1][2].

Mitigation

The vulnerability is fixed in Vim 8.2, patch 8.2.4215 [3]. Users should upgrade to Vim 8.2.4215 or later. For Gentoo Linux users, the fixed version is app-editors/vim-9.0.0060 (or later) and similar for gVim and vim-core packages [4]. Apple released patches for macOS Ventura 13 (October 24, 2022) and macOS Monterey 12.6 (September 12, 2022) that address this CVE [1][2]. No other workaround is known. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.

References
  1. About the security content of macOS Ventura 13 - Apple Support
  2. About the security content of macOS Monterey 12.6 - Apple Support
  3. patch 8.2.4215: illegal memory access when copying lines in Visual mode · vim/vim@dc5490e
  4. Multiple Vulnerabilities (GLSA 202208-32) — Gentoo security

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

45

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.