VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 1, 2022· Updated Aug 3, 2024

Heap-based Buffer Overflow in vim/vim

CVE-2022-2580

Description

A heap-based buffer overflow in vim's string evaluation logic, prior to 9.0.0102, can lead to arbitrary code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap-based buffer overflow in vim's string evaluation logic, prior to 9.0.0102, can lead to arbitrary code execution.

Vulnerability

A heap-based buffer overflow exists in the eval_string function in vim's source code, as demonstrated in commit [1]. The vulnerability occurs when evaluating strings with special keycode notation (<...>). In versions prior to 9.0.0102, the code reserves 5 extra bytes for such notation but fails to properly account for the length of the keycode after parsing, potentially writing beyond the allocated buffer. This affects all vim builds before the patched version 9.0.0102.

Exploitation

An attacker can trigger this vulnerability by crafting a malicious input file or command that includes a specially formed keycode sequence (e.g., <\(...\)>). The attacker does not require any special privileges beyond the ability to have vim process the crafted input. No user interaction beyond opening the file or executing the command is needed. The parsing logic in eval_string will overflow the heap buffer when processing the malformed keycode.

Impact

Successful exploitation results in a heap-based buffer overflow, which can corrupt adjacent heap memory. An attacker could leverage this to achieve arbitrary code execution with the privileges of the user running vim. The vulnerability is classified as critical with a high CVSS score, indicating a serious risk of full system compromise if vim is run in elevated contexts.

Mitigation

The vulnerability is fixed in vim release 9.0.0102, published on 2022-08-01 [1]. Users should update to vim version 9.0.0102 or later immediately. There is no known workaround for unpatched versions. The issue was reported via the huntr.dev bug bounty platform [2].

References
  1. patch 9.0.0104: going beyond allocated memory when evaluating string … · vim/vim@1e56bda
  2. The world’s first bug bounty platform for AI/ML

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.