Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-2231: Vim text editor crashes when processing certain files

CVE-2022-2231 · published 4 years ago

Summary

If you're using a version of Vim prior to 8.2, an attacker could potentially cause the editor to crash by manipulating the system. This is a concern if you rely on Vim for critical tasks. Update to version 8.2 or later to resolve the issue.

What to do

Update debian vim to version 2:9.0.0135-1.
Update vim vim to version 8.2.5169 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	vim	vim	< 8.2.5169 `cpe:2.3:a:vim:vim::::::::`
–	fedoraproject	fedora	35 36 `cpe:2.3:o:fedoraproject:fedora:35:::::::*`
Debian:12	debian	vim	< 2:9.0.0135-1 Fix: upgrade to 2:9.0.0135-1

Original advisory text

NULL Pointer Dereference in vim/vim

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.

References

https://security-tracker.debian.org/tracker/CVE-2022-2231 Vendor Advisory
https://huntr.dev/bounties/8dae6ab4-7a7a-4716-a65c-9b090fa057b5 URL
https://security.gentoo.org/glsa/202208-32 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2231.j... Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2231 Vendor Advisory
https://security.gentoo.org/glsa/202305-16 Vendor Advisory
https://github.com/vim/vim/commit/79481367a457951aabd9501b510fd7e3eb29c3d8 Patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

5.5 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published28 Jun 2022

Updated4 Nov 2026

First seen11 Apr 2026

Sources

CVE-2022-2231 · OSV

CVE-2022-2231 · NVD

DEBIAN-CVE-2022-2231 · OSV

Track software like this

Free during beta