VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 17, 2022· Updated Aug 3, 2024

Heap-based Buffer Overflow in vim/vim

CVE-2022-3234

Description

Heap buffer overflow in Vim's replace command in virtualedit mode allows potential code execution; fixed in 9.0.0483.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Heap buffer overflow in Vim's replace command in virtualedit mode allows potential code execution; fixed in 9.0.0483.

Vulnerability

A heap-based buffer overflow exists in the op_replace function of Vim's source code (prior to version 9.0.0483) when executing replace operations in virtualedit mode. The issue occurs due to insufficient bounds checking when handling cursor positions after editing, particularly with tabs and virtual columns. An attacker can trigger this by crafting a file that, when opened and edited with a replace command, leads to illegal memory access [1].

Exploitation

To exploit, an attacker must convince a user to open a maliciously crafted file and then perform a replace operation while in virtualedit mode. No prior authentication is required, but the user must interact with the editor by executing the replace command. The vulnerable code path is reached when op_replace handles replacement in virtualedit mode, and specifically when the cursor position after replacement is not properly validated [1].

Impact

Successful exploitation can lead to memory corruption, potentially allowing arbitrary code execution in the context of the Vim process. This could enable an attacker to compromise the user's system beyond the editor, depending on the privileges of the Vim session.

Mitigation

The vulnerability is fixed in Vim version 9.0.0483, which includes the commit c249913edc35c0e666d783bfc21595cf9f7d9e0d [1]. Users should upgrade to this version or later. As a workaround, avoid using replace commands in virtualedit mode on untrusted files. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

References
  1. patch 9.0.0483: illegal memory access when replacing in virtualedit mode · vim/vim@c249913

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

41

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing bounds check before `PBYTE` write in `op_replace` when virtualedit mode is active allows heap buffer overflow."

Attack vector

An attacker can trigger a heap-based buffer overflow by crafting a file that, when opened and edited with the replace command (`R` or `r`) in virtualedit mode, causes `op_replace` to write past the allocated memory. The bug occurs because the code could call `PBYTE(curwin->w_cursor, c)` without first verifying that the cursor position still points to a valid character (i.e., `gchar_cursor() != NUL`), leading to an illegal memory access [ref_id=1]. The attack requires the victim to open the malicious file and perform a replace operation in virtualedit mode.

Affected code

The vulnerability resides in the `op_replace` function in Vim's source code. The patch modifies the logic that handles character replacement when `virtual_op` (virtualedit mode) is active, specifically around the `PBYTE` macro call and the condition that checks `oap->end.lnum`.

What the fix does

The patch introduces a `done` flag and adds guard checks before the `PBYTE` call. Specifically, it wraps `PBYTE(curwin->w_cursor, c)` inside an `if (gchar_cursor() != NUL)` check, ensuring the cursor still points to a valid character before writing [ref_id=1]. Additionally, the condition for the virtualedit fallback block is changed from `else if` to `if (!done && ...)`, preventing both code paths from executing when the replacement was already handled. These changes prevent the heap buffer overflow by ensuring memory writes only occur when the cursor position is valid.

Preconditions

  • inputVictim must open a crafted file in Vim
  • configVictim must perform a replace operation (R or r) while virtualedit mode is active

Generated on May 28, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.