VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 28, 2022· Updated Aug 3, 2024

NULL Pointer Dereference in vim/vim

CVE-2022-2231

Description

A NULL pointer dereference in Vim's expression evaluation can be triggered by a crafted file, leading to a crash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A NULL pointer dereference in Vim's expression evaluation can be triggered by a crafted file, leading to a crash.

Vulnerability

A NULL pointer dereference exists in the eval0_retarg function of Vim's expression evaluation code. The bug occurs when a nested :source command is processed; under certain conditions the pointer p becomes NULL and is subsequently used without a check, causing a crash. The issue affects Vim versions prior to patch 8.2.5169 (i.e., before 8.2). The fix, shown in commit [1], adds a NULL check for p before it is dereferenced.

Exploitation

An attacker can exploit this vulnerability by crafting a file that triggers the nested :source code path. The attacker must convince a user to open the malicious file in Vim (e.g., via social engineering or by embedding it in a repository). No authentication or special network position is required beyond user interaction. The crafted file causes Vim to dereference a NULL pointer, resulting in a segmentation fault and crash.

Impact

Successful exploitation leads to a denial of service (crash) of Vim. The vulnerability is a NULL pointer dereference, which typically results in a segmentation fault. No code execution or data compromise is indicated in the available references; the impact is limited to availability.

Mitigation

The vulnerability is fixed in Vim patch 8.2.5169 [1]. Users should upgrade to Vim 8.2.5169 or later. The Gentoo security advisory [4] recommends upgrading to version 9.0.0060 or higher. No workaround is known. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

References
  1. patch 8.2.5169: nested :source may use NULL pointer · vim/vim@7948136
  2. Multiple Vulnerabilities (GLSA 202208-32) — Gentoo security

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing NULL pointer check in expression evaluation allows dereference of NULL pointer during nested :source commands."

Attack vector

An attacker can trigger a NULL pointer dereference by crafting a file that causes `eval0_retarg` to be called with a `:source` command that results in a NULL pointer being passed to `skipwhite(p)`. The vulnerable code path occurs when `ret != FAIL` but `p` has become NULL after expression evaluation, and the subsequent `skipwhite(p)` call dereferences the NULL pointer. This can be exploited by providing a specially crafted Vim script file that, when sourced, triggers the vulnerable code path [ref_id=1].

Affected code

The vulnerability is in the `eval0_retarg` function in Vim's expression evaluation code. The patch modifies the logic around `expr_end = p; p = skipwhite(p);` and the subsequent Vim9 script comment-skipping loop, as well as the `eap->nextcmd` assignment on line 2443. The core issue is that `p` can be NULL when `skipwhite(p)` is called, leading to a NULL pointer dereference.

What the fix does

The patch wraps the `expr_end = p; p = skipwhite(p);` assignment and the Vim9 comment-skipping loop inside a `if (ret != FAIL)` block, ensuring these operations only execute when the expression evaluation succeeded. Additionally, the patch adds a `p != NULL` check before the `skipwhite(p)` call on the `eap->nextcmd` assignment line. These changes prevent the NULL pointer from being dereferenced by guarding all code paths that previously assumed `p` was always valid [ref_id=1].

Preconditions

  • inputAttacker must provide a crafted Vim script file that triggers the vulnerable code path in eval0_retarg
  • authUser must source the malicious file using :source command or equivalent

Generated on May 28, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.