VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 3, 2022· Updated Nov 3, 2025

Use After Free in vim/vim

CVE-2022-3099

Description

Use-after-free in Vim's :for loop handling could cause a crash or potential code execution; fixed in 9.0.0360.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Use-after-free in Vim's `:for` loop handling could cause a crash or potential code execution; fixed in 9.0.0360.

Vulnerability

A use-after-free vulnerability exists in Vim's do_cmdline function when processing :for loops with an invalid line count. Affected versions are prior to 9.0.0360 [1].

Exploitation

An attacker can trigger the vulnerability by providing a crafted Vim script file that includes a :for loop referencing an invalid line number. Opening the file in a vulnerable Vim version causes a use-after-free condition [1].

Impact

Successful exploitation leads to a crash (denial of service) and could potentially allow arbitrary code execution due to the use-after-free nature, though no public exploit code is documented [1].

Mitigation

The issue is fixed in Vim 9.0.0360 [1]. Users should update to this version or later. No known workarounds exist for unpatched versions.

References
  1. patch 9.0.0360: crash when invalid line number on :for is ignored · vim/vim@35d21c6

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

41

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.