VYPR
← All advisories
Unrated severityNVD Advisory· Published May 18, 2022· Updated Aug 3, 2024

Uncontrolled Recursion in vim/vim

CVE-2022-1771

Description

Vim's command-line mode could enter infinite recursion leading to crash; fixed in 8.2.4975.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Vim's command-line mode could enter infinite recursion leading to crash; fixed in 8.2.4975.

Vulnerability

Uncontrolled recursion in the getcmdline_int() function in Vim versions prior to 8.2.4975 allows a crash when a specially crafted command line causes excessive recursion depth. The issue is in the command-line mode processing logic [1].

Exploitation

An attacker can trigger this by providing input that causes recursive calls within getcmdline_int(), leading to a stack overflow. No authentication is needed if the attacker can control command-line input (e.g., via a file or interactive session) [1].

Impact

Successful exploitation results in a denial of service (crash) due to stack exhaustion. Information disclosure or remote code execution are not reported [1].

Mitigation

Fixed in Vim version 8.2.4975. Users should update to 8.2.4975 or later. Gentoo recommends upgrading to >=app-editors/vim-9.0.0060 or >=app-editors/vim-9.0.1157 [2][3].

References
  1. patch 8.2.4975: recursive command line loop may cause a crash · vim/vim@51f0bfb
  2. Multiple Vulnerabilities (GLSA 202208-32) — Gentoo security
  3. Multiple Vulnerabilities (GLSA 202305-16) — Gentoo security

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

38

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing recursion depth guard in getcmdline_int() allows uncontrolled stack recursion leading to crash."

Attack vector

An attacker can trigger a recursive call loop in `getcmdline_int()` by crafting input that causes the command-line handler to invoke itself repeatedly without returning. Each recursive call consumes stack space, and without a depth limit the recursion eventually causes a stack overflow and crash [ref_id=1]. The attack requires the victim to open a malicious file or execute crafted commands in Vim.

Affected code

The vulnerability is in the `getcmdline_int()` function in Vim's command-line input handling. The function is recursive but had no depth guard, allowing uncontrolled recursion [ref_id=1].

What the fix does

The patch introduces a static `depth` counter that is incremented on each entry to `getcmdline_int()` and decremented on exit. When `depth` reaches 50, the function emits an error message ("E1234: Command too recursive") and bails out via `goto theend` instead of recursing further [ref_id=1]. This caps the recursion depth and prevents stack exhaustion.

Preconditions

  • inputVictim must open a malicious file or execute crafted commands in Vim
  • authNo special authentication or network access required; local exploitation

Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.