Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-2210: Vim Before 8.2 Allows Unauthorized Data Overwrite

CVE-2022-2210 · published 4 years ago

Summary

An old version of Vim, a text editor, has an error that could let an attacker overwrite data they shouldn't have access to. This affects older versions of Vim before version 8.2. Update to the latest version of Vim to fix this issue.

What to do

Update debian vim to version 2:9.0.0135-1.
Update vim vim to version 8.2.5164 or later.
Update vim vim/vim to version 8.2 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	vim	< 2:9.0.0135-1 Fix: upgrade to 2:9.0.0135-1
–	vim	vim	< 8.2.5164 `cpe:2.3:a:vim:vim::::::::`
–	fedoraproject	fedora	35 36 `cpe:2.3:o:fedoraproject:fedora:35:::::::*`
–	vim	vim/vim	< 8.2

Original advisory text

Out-of-bounds Write in vim/vim

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

References

https://huntr.dev/bounties/020845f8-f047-4072-af0f-3726fe1aea25 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2210.j... Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2210 Vendor Advisory
https://github.com/vim/vim/commit/c101abff4c6756db4f5e740fde289decb9452efa Patch
https://security.gentoo.org/glsa/202208-32 Vendor Advisory
https://security.gentoo.org/glsa/202305-16 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2022-2210 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published27 Jun 2022

Updated4 Nov 2026

First seen11 Apr 2026

Sources

CVE-2022-2210 · OSV

CVE-2022-2210 · NVD

CVE-2022-2210 · MITRE

DEBIAN-CVE-2022-2210 · OSV

Track software like this

Free during beta