VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 18, 2022· Updated Aug 3, 2024

NULL Pointer Dereference in vim/vim

CVE-2022-2874

Description

A NULL pointer dereference in Vim prior to 9.0.0224 can lead to a crash when skippping compiled code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A NULL pointer dereference in Vim prior to 9.0.0224 can lead to a crash when skippping compiled code.

Vulnerability

A NULL pointer dereference vulnerability exists in the generate_loadvar and compile_assign_unlet functions of vim/vim prior to version 9.0.0224. The code did not properly check whether the compilation context's ctx_skip flag was set to SKIP_YES before accessing local variable pointers, leading to a NULL pointer dereference. This occurs when certain compiled code paths are skipped. The vulnerable versions are all prior to the fix commit 4875d6ab068f09df88d24d81de40dcd8d56e243d [1].

Exploitation

An attacker would need to provide a crafted file that triggers the execution of a Vim script containing specific constructs that cause the compiler to skip code blocks. For example, a script with conditional compilation or loops that lead to the SKIP_YES state in the compiler context could trigger the NULL pointer dereference. No user interaction beyond opening the malicious file is required. The vulnerability does not require any special network access or authentication; it can be triggered locally by opening a crafted file in Vim [1][3].

Impact

Successful exploitation results in a denial of service due to a program crash (NULL pointer dereference), potentially causing loss of unsaved work. The vulnerability does not allow arbitrary code execution or privilege escalation; the impact is limited to a crash of the Vim application [1][2].

Mitigation

The vulnerability is fixed in Vim version 9.0.0224 released on 2022-08-18. Users should upgrade to Vim 9.0.0224 or later. Gentoo Linux has provided updated packages in GLSA 202305-16 recommending version 9.0.1157 for all Vim, gVim, and vim-core users. There is no known workaround for unpatched versions [1][2].

References
  1. patch 9.0.0224: Using NULL pointer when skipping compiled code · vim/vim@4875d6a
  2. Multiple Vulnerabilities (GLSA 202305-16) — Gentoo security
  3. The world’s first bug bounty platform for AI/ML

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing NULL pointer guard when skipping compiled code allows dereference of a NULL pointer in Vim's code generation functions."

Attack vector

An attacker can trigger a NULL pointer dereference by providing a crafted Vim script that causes the compiler to skip compiled code while still attempting to access local variable or assignment structures. When `cctx->ctx_skip` is set to `SKIP_YES`, the code previously would still call `generate_LOADOUTER()` or `generate_LOAD()` on a NULL or invalid pointer [ref_id=1]. This can lead to a crash (denial of service) when Vim processes the malicious input.

Affected code

The vulnerability is in the Vim source file where `generate_loadvar()` and `compile_assign_unlet()` are defined. The patch modifies `generate_loadvar()` (around line 1165) and `compile_assign_unlet()` (around line 1952) to guard against NULL pointer dereferences when `cctx->ctx_skip == SKIP_YES` [ref_id=1].

What the fix does

The patch adds early-return guards in two locations. In `generate_loadvar()`, the code that calls `generate_LOADOUTER()` or `generate_LOAD()` is now wrapped inside a check for `cctx->ctx_skip != SKIP_YES`, preventing execution when skipping is active [ref_id=1]. In `compile_assign_unlet()`, an early `return OK` is added when `cctx->ctx_skip == SKIP_YES`, avoiding the subsequent load operations on potentially NULL pointers [ref_id=1]. These changes ensure that no code generation is attempted when the context indicates the code should be skipped.

Preconditions

  • inputThe attacker must supply a crafted Vim script that triggers the skip-compilation code path.
  • authThe victim must open or execute the malicious script in Vim prior to version 9.0.0224.

Generated on May 28, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.