VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 19, 2022· Updated Nov 3, 2025

Out-of-bounds Write in vim/vim

CVE-2022-2129

Description

Out-of-bounds write in Vim's substitute command (prior to patch 8.2.5126) allows memory corruption via a crafted file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Out-of-bounds write in Vim's substitute command (prior to patch 8.2.5126) allows memory corruption via a crafted file.

Vulnerability

An out-of-bounds write vulnerability exists in the :substitute command of Vim, specifically when editing a script file from within an expression in the replacement string. The bug is in the do_sub function and can cause the destination buffer to be overrun. Affected are Vim versions prior to patch 8.2.5126 [1]. The issue was introduced earlier and fixed in commit d6211a5.

Exploitation

An attacker can exploit this by crafting a text file that, when opened in Vim and the user executes a substitute command with a specific pattern and expression replacement, triggers the out-of-bounds write. The user interaction is required to invoke the substitute command (e.g., :s/\%')/\=SomeFunc()). No authentication or special network position is needed; the vulnerability is local and file-based.

Impact

Successful exploitation could lead to memory corruption, potentially resulting in arbitrary code execution or a denial of service (crash). The exact impact depends on the operating system and memory layout [1][4].

Mitigation

The vulnerability is fixed in Vim version 8.2.5126 [1]. Upstream recommends upgrading to this or a later version. Gentoo users can upgrade to >=app-editors/vim-9.0.0060 [4]. No workarounds are disclosed; updating is the only mitigation.

References
  1. patch 8.2.5126: substitute may overrun destination buffer · vim/vim@d6211a5
  2. Multiple Vulnerabilities (GLSA 202208-32) — Gentoo security

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.