VYPR
← All advisories
Unrated severityNVD Advisory· Published May 7, 2022· Updated Nov 3, 2025

Use after free in append_command in vim/vim

CVE-2022-1616

Description

Use-after-free in append_command in Vim prior to 8.2.4895 allows arbitrary code execution via crafted command-line input.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Use-after-free in `append_command` in Vim prior to 8.2.4895 allows arbitrary code execution via crafted command-line input.

Vulnerability

A use-after-free vulnerability exists in the append_command function in Vim's source code (src/ex_getln.c). When processing specially crafted command-line input containing composing characters, the function could write beyond the allocated buffer (IObuff), leading to memory corruption. This issue affects all versions of Vim prior to the patched release 8.2.4895 [2].

Exploitation

An attacker can trigger the vulnerability by providing a crafted input string that includes composing characters (e.g., 0\xdd\x80\xdd\x80\xdd\x80\xdd\x80) combined with leading zeros. No special privileges are required; the attacker only needs to convince a target user to open a malicious file or execute a crafted command in Vim. The race condition in the buffer handling can cause the use-after-free when Vim attempts to display an error message for the invalid command, as demonstrated by the provided test case [2].

Impact

Successful exploitation can lead to arbitrary code execution on the victim's system. The vulnerability also allows bypassing protection mechanisms and modifying memory, potentially enabling full compromise of the affected system. The impact is rated as high severity due to the ability to execute arbitrary code [2].

Mitigation

Vim version 8.2.4895 contains the fix for this issue, released on the same day as the CVE publication (May 7, 2022) [2]. Users should upgrade to Vim 8.2.4895 or later. If upgrading is not immediately possible, limiting the opening of untrusted files and avoiding the execution of untrusted commands can reduce risk. Apple also addressed this vulnerability in macOS Ventura 13 security updates, referencing CVE-2022-1616 as part of a broader security fix [1]. No further workarounds are documented in the available references.

References
  1. About the security content of macOS Ventura 13 - Apple Support
  2. patch 8.2.4895: buffer overflow with invalid command with composing c… · vim/vim@d889344

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

38

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.