VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 23, 2022· Updated May 22, 2025

NULL Pointer Dereference in vim/vim

CVE-2022-3278

Description

A NULL pointer dereference in Vim before 9.0.0552 can be exploited via a crafted file to cause a denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A NULL pointer dereference in Vim before 9.0.0552 can be exploited via a crafted file to cause a denial of service.

Vulnerability

A NULL pointer dereference vulnerability exists in Vim (and gVim) prior to version 9.0.0552. The flaw occurs when the editor processes certain input, leading to a dereference of a null pointer. The exact code path is not detailed in the available references, but the issue is present in all versions before the fix.

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted file with Vim. No special privileges or network access are required beyond the ability to deliver the malicious file to the victim. The user interaction of opening the file triggers the null pointer dereference.

Impact

Successful exploitation results in a denial of service (DoS) due to a crash of the Vim process. The Gentoo security advisory [4] lists this CVE among multiple vulnerabilities that could lead to denial of service. No code execution or data compromise is indicated.

Mitigation

The fix was included in Vim version 9.0.0552 and later. Users should upgrade to at least that version. The Gentoo advisory [4] recommends upgrading to >=9.0.1157 for a comprehensive fix. No workaround is available. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.

References
  1. Multiple Vulnerabilities (GLSA 202305-16) — Gentoo security

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

40

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.