VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 27, 2022· Updated Nov 3, 2025

Stack-based Buffer Overflow in vim/vim

CVE-2022-3324

Description

A stack-based buffer overflow in Vim's window width handling (<=9.0.0598) allows out-of-bounds write via crafted commands, leading to arbitrary code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A stack-based buffer overflow in Vim's window width handling (<=9.0.0598) allows out-of-bounds write via crafted commands, leading to arbitrary code execution.

Vulnerability

A stack-based buffer overflow exists in the win_new_width function in src/window.c of Vim prior to patch 9.0.0598 [1]. The function assigns a potentially negative width value directly to wp->w_width without validation, causing out-of-bounds memory access when the negative value is later used as an array index. Affected versions include all releases before 9.0.0598, as well as Fedora packages shipped before the respective updates [2][3][4].

Exploitation

An attacker with local terminal access or the ability to trick a user into opening a crafted file can trigger the vulnerability. The exploit sequence typically involves setting a negative window width via commands such as winsize 0 0, combined with key mappings that force window operations (e.g., ``). No authentication is required beyond a normal Vim session [1].

Impact

Successful exploitation results in an out-of-bounds memory write, which can be leveraged to achieve arbitrary code execution or crash Vim. The attacker gains the privilege level of the user running Vim, potentially leading to full host compromise if that user has elevated rights [1].

Mitigation

The vulnerability is fixed in Vim version 9.0.0598, released on 2022-09-27 [1]. Users should upgrade to this version or later. Fedora package updates were announced on 2022-10-05 for F36 [2], F35 [3], and F37 [4]; apply those updates. If patching is not immediately possible, avoid opening untrusted files or executing arbitrary commands in Vim.

References
  1. patch 9.0.0598: using negative array index with negative width window · vim/vim@8279af5
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

40

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.