VYPR
← All advisories
Unrated severityNVD Advisory· Published May 9, 2022· Updated Aug 3, 2024

Heap buffer overflow in vim_strncpy find_word in vim/vim

CVE-2022-1621

Description

Heap buffer overflow in vim_strncpy find_word in Vim before 8.2.4919 allows denial of service and possible remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Heap buffer overflow in vim_strncpy find_word in Vim before 8.2.4919 allows denial of service and possible remote code execution.

Vulnerability

Heap buffer overflow in the vim_strncpy function used by find_word in Vim prior to version 8.2.4919. The bug occurs when processing specially crafted text with the :spellgood command, allowing invalid bytes to be added to the word tree. Affected versions: all Vim versions before 8.2.4919. [2]

Exploitation

An attacker can exploit this by providing a maliciously crafted file or text that triggers the :spellgood command with invalid UTF-8 bytes. No authentication is required if the victim opens the file. The attacker needs to convince the user to open the file or trigger the spell checking functionality. The vulnerability is reachable when spell checking is enabled. [2]

Impact

Successful exploitation can cause a heap buffer overflow, leading to a crash (denial of service), bypass of protection mechanisms, memory corruption, and potentially arbitrary code execution. The impact is high, with CVSS score likely high. [description]

Mitigation

Fixed in Vim version 8.2.4919, released on the commit date (2022-05-09). Users should upgrade to at least that version. Gentoo recommends upgrading to >=9.0.0060. [2][4] Apple included a fix in macOS Ventura 13. [1] No workaround is available. [4]

References
  1. About the security content of macOS Ventura 13 - Apple Support
  2. patch 8.2.4919: can add invalid bytes with :spellgood · vim/vim@7c82468
  3. Multiple Vulnerabilities (GLSA 202208-32) — Gentoo security

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

8

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing validation of UTF-8 string validity in `store_word` and `spell_add_word` allows illegal bytes to trigger a heap buffer overflow in `vim_strncpy`/`find_word`."

Attack vector

An attacker can trigger a heap buffer overflow by providing a specially crafted word containing invalid UTF-8 bytes to the `:spellgood` command. The patch's test shows the payload `0\xac` (a NUL byte followed by 0xac) passed to `spellgood!` triggers the error. No authentication is required if the attacker can supply input to Vim's spell-checking functionality [ref_id=1].

Affected code

The vulnerability resides in the `store_word` function and the `spell_add_word` function in Vim's spell-checking code. Both functions call `utf_valid_string()` to validate input before processing, but prior to the patch they lacked this check, allowing invalid UTF-8 bytes to reach the word tree via `vim_strncpy` and `find_word`.

What the fix does

The patch adds a call to `utf_valid_string()` at the beginning of both `store_word` and `spell_add_word` when `enc_utf8` is set. If the input word contains illegal UTF-8 bytes, the function returns `FAIL` (in `store_word`) or emits error `E1280` and returns early (in `spell_add_word`). This prevents invalid bytes from being copied into the word tree, avoiding the heap buffer overflow in `vim_strncpy`/`find_word` [ref_id=1].

Preconditions

  • configVim must be compiled with the FEAT_SPELL feature enabled
  • inputAttacker must be able to supply input to the :spellgood command (e.g., via a crafted file or direct command)

Reproduction

Run `spellgood! 0\xac` in Vim (the test uses `call assert_fails("spellgood! 0\u0002\xac", 'E1280:')`). Prior to the patch, this causes a heap buffer overflow in `vim_strncpy`/`find_word` [ref_id=1].

Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.