VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 25, 2022· Updated Nov 3, 2025

Heap-based Buffer Overflow in vim/vim

CVE-2022-4141

Description

Heap buffer overflow in Vim ≤9.0.0946 via CTRL-W gf in substitute expression allows arbitrary code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Heap buffer overflow in Vim ≤9.0.0946 via CTRL-W gf in substitute expression allows arbitrary code execution.

Vulnerability

A heap-based buffer overflow exists in Vim versions 9.0.0946 and below. The flaw occurs in the substitute command when the right-hand side expression contains a CTRL-W gf sequence that attempts to open another file. The code path does not properly validate text locking, leading to an invalid memory access [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious file that, when opened in Vim, triggers a substitute command with an expression containing CTRL-W gf. The user must execute the substitute command (e.g., via :s/// or similar) while the crafted file is active. No authentication is required beyond the user opening the file. The sequence of steps involves the attacker providing the file, the user opening it, and the user running the substitute command, which then causes the heap overflow [1].

Impact

Successful exploitation results in heap memory corruption, which can lead to arbitrary code execution or denial of service. The attacker gains the privileges of the user running Vim, potentially compromising the system [1].

Mitigation

The vulnerability is fixed in Vim version 9.0.0947, as per commit cc762a48d42b579fb7bdec2c614636b830342dd5 [1]. Gentoo security advisory GLSA 202305-16 recommends upgrading to Vim ≥9.0.1157 [4]. No workaround is available; users should update to the latest patched version.

References
  1. patch 9.0.0947: invalid memory access in substitute with function · vim/vim@cc762a4
  2. Multiple Vulnerabilities (GLSA 202305-16) — Gentoo security

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

38

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.