VYPR
← All advisories
Unrated severityNVD Advisory· Published May 8, 2022· Updated Aug 3, 2024

Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim

CVE-2022-1619

Description

A heap-based buffer overflow in Vim's cmdline_erase_chars prior to 8.2.4899 could allow remote code execution via a crafted command line.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap-based buffer overflow in Vim's cmdline_erase_chars prior to 8.2.4899 could allow remote code execution via a crafted command line.

Vulnerability

A heap-based buffer overflow exists in the cmdline_erase_chars function in Vim prior to version 8.2.4899 [2]. The flaw occurs when handling the `` key with latin1 encoding, where a missing bounds check allows out-of-bounds memory access [2]. Versions before the patch are affected, including older macOS Ventura distributions [1].

Exploitation

An attacker would need to convince a user to open a specially crafted file or type a sequence that includes a space followed by `` on the command line [2]. The vulnerability is triggered when the function fails to verify the buffer pointer remains within bounds, particularly with latin1 encoding [2]. Local access is required; no network vector is indicated.

Impact

Successful exploitation can cause a heap-based buffer overflow, leading to application crash, memory corruption, and potentially arbitrary code execution [1]. The impact depends on the specific heap layout, but the advisory classifies it as "critical" due to the possibility of remote execution [1][2].

Mitigation

Vim fixed the issue in version 8.2.4899, released on May 8, 2022 [2]. Users should update to this version or later. Apple included the fix in macOS Ventura 13, released October 24, 2022 [1]. No workaround is documented; an abundance of caution advises against opening untrusted files in affected versions.

References
  1. About the security content of macOS Ventura 13 - Apple Support
  2. patch 8.2.4899: with latin1 encoding CTRL-W might go before the cmdline · vim/vim@ef02f16

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

38

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing bounds check before decrementing the pointer `p` in `cmdline_erase_chars` allows it to go before the start of the command-line buffer when CTRL-W is pressed at position zero under latin1 encoding."

Attack vector

An attacker can trigger a heap-based buffer overflow by sending a crafted command-line sequence to Vim when the encoding is set to `latin1`. Specifically, pressing CTRL-W (word-delete) when the cursor is already at the start of the command line causes `p` to decrement below `ccline.cmdbuff`, writing before the allocated heap buffer. This can crash Vim, corrupt adjacent heap memory, and potentially lead to remote code execution. The precondition is that Vim is running with `latin1` encoding and the attacker can supply input that places the command-line cursor at position zero before issuing CTRL-W.

Affected code

The vulnerability is in the `cmdline_erase_chars` function in Vim's command-line editing code. The patch modifies the logic that handles CTRL-W (delete word backward) when the `latin1` encoding is active. The defect is in the while-loop that decrements `p` without first checking whether `p` already points to the start of `ccline.cmdbuff`.

What the fix does

The patch adds a guard `if (p > ccline.cmdbuff)` before the inner while-loop that decrements `p` in the word-delete path. This ensures that when `p` is already at the start of the command buffer, the loop body is skipped entirely, preventing `p` from being decremented below the buffer boundary. The fix also adds a regression test that feeds the sequence `: \

Preconditions

  • configVim must be running with 'latin1' encoding active
  • inputAttacker must be able to supply command-line input that places the cursor at position 0 before pressing CTRL-W

Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.