Log in Start free

Vulnerability · Published Apr 17, 2022 · Assigned by @huntrdev

CVE-2022-1381global heap buffer overflow in skip_range in vim/vim

High 7.8

In plain English

A high-severity heap buffer overflow in vim/vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.8High
Exploit odds (30 days)3.1%top 12.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20vim8.2.4836-r0ALPINE-CVE-2022-1381
Alpine:v3.21vim8.2.4836-r0ALPINE-CVE-2022-1381
Alpine:v3.22vim8.2.4836-r0ALPINE-CVE-2022-1381
Alpine:v3.23vim8.2.4836-r0ALPINE-CVE-2022-1381
Alpine:v3.24vim8.2.4836-r0ALPINE-CVE-2022-1381
Debian:12vim2:8.2.4793-1DEBIAN-CVE-2022-1381
Debian:13vim2:8.2.4793-1DEBIAN-CVE-2022-1381
Debian:14vim2:8.2.4793-1DEBIAN-CVE-2022-1381

Affected products (as reported)

VendorProductVersions
vim vim/vim unspecified – before 8.2.4763

Weakness: CWE-122 · Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

References