VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 5, 2022· Updated Apr 14, 2025

Floating Point Comparison with Incorrect Operator in vim/vim

CVE-2022-4293

Description

Vim prior to 9.0.0804 contains a floating point comparison flaw allowing denial of service via crafted file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Vim prior to 9.0.0804 contains a floating point comparison flaw allowing denial of service via crafted file.

Vulnerability

A floating point comparison with an incorrect operator exists in Vim versions prior to 9.0.0804. The bug occurs during evaluation of certain expressions, leading to undefined behavior. The affected code path can be triggered when processing a crafted file or by executing specific commands in Vim. The issue is addressed in commit cdef1cefa2a440911c727558562f83ed9b00e16b [2].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted file or to execute a malicious Vim script. No authentication is required; the user must interact with the crafted input. The bug may cause an invalid floating point comparison resulting in a crash or incorrect program behavior [1].

Impact

Successful exploitation can lead to denial of service via application crash. In some cases, it may also cause incorrect evaluation of expressions, potentially leading to unintended data manipulation or information disclosure, though the primary impact is denial of service [1].

Mitigation

The fix was included in Vim version 9.0.0804, released on December 5, 2022. Users should upgrade to at least this version. Gentoo security advisory GLSA 202305-16 recommends upgrading to >=9.0.1157 [1]. No workaround is available [1].

References
  1. Multiple Vulnerabilities (GLSA 202305-16) — Gentoo security
  2. patch 9.0.0804: crash when trying to divide a number by -1 · vim/vim@cdef1ce

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

38

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.