VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 15, 2022· Updated Aug 3, 2024

Heap-based Buffer Overflow in vim/vim

CVE-2022-2819

Description

A heap-based buffer overflow in Vim's :lockvar command allows arbitrary code execution via crafted script input prior to version 9.0.0211.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap-based buffer overflow in Vim's `:lockvar` command allows arbitrary code execution via crafted script input prior to version 9.0.0211.

Vulnerability

A heap-based buffer overflow exists in the compile_lock_unlock() function of Vim, affecting versions prior to 9.0.0211 [1]. The vulnerability occurs when the :lockvar command is invoked with no argument, leading to an invalid memory access during compilation of Vim script [1]. The affected code path is reachable when a user opens a crafted Vim script file or executes the vulnerable command [1].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted Vim script that triggers the compile_lock_unlock() function with an empty argument for :lockvar [1]. The attacker does not require authentication; the victim must only open the malicious script in Vim or execute the :lockvar command with crafted input [1]. The exploit does not require user interaction beyond loading the file or executing the command [1].

Impact

Successful exploitation results in a heap-based buffer overflow, potentially leading to arbitrary code execution, denial of service, or memory corruption [1][2]. The attacker gains the ability to execute arbitrary code with the privileges of the user running Vim [1][2].

Mitigation

The vulnerability is fixed in Vim version 9.0.0211, released on 2022-08-15 [1]. Users should upgrade to this version or later [1]. Gentoo Linux has provided updated packages (>=app-editors/vim-9.0.1157) as part of GLSA 202305-16 [3]. No workaround is available [3]. This CVE is not listed in the Known Exploited Vulnerabilities (KEV) catalog as of this writing.

References
  1. patch 9.0.0211: invalid memory access when compiling :lockvar · vim/vim@d1d8f6b
  2. Making sure you're not a bot!
  3. Multiple Vulnerabilities (GLSA 202305-16) — Gentoo security

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

Synthesis attempt was rejected by the grounding validator. Re-run pending.

References

4

News mentions

0

No linked articles in our index yet.