VYPR
← All advisories
Unrated severityNVD Advisory· Published May 16, 2022· Updated Aug 3, 2024

Buffer Over-read in function grab_file_name in vim/vim

CVE-2022-1720

Description

Buffer over-read in Vim's grab_file_name function prior to 8.2.4956 can lead to crash, memory modification, or remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Buffer over-read in Vim's grab_file_name function prior to 8.2.4956 can lead to crash, memory modification, or remote code execution.

Vulnerability

A buffer over-read vulnerability exists in the grab_file_name function in Vim versions prior to 8.2.4956. The bug is triggered when processing a specially crafted file, leading to reading beyond the allocated buffer.

Exploitation

An attacker can exploit this by providing a malicious file to a user or system running an affected Vim version. No authentication is required if the victim opens the file. The attacker does not need special network position; local file access or social engineering suffices.

Impact

Successful exploitation can cause a crash, memory corruption, and potentially arbitrary code execution with the privileges of the Vim process.

Mitigation

The vulnerability is fixed in Vim version 8.2.4956. Users should update to this version or later. No workaround is available. The CVE is not listed in the KEV catalog.

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

15

News mentions

0

No linked articles in our index yet.