Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2022-4293: Older Versions of Vim May Crash When Comparing Floating Point Numbers
CVE-2022-4293 · published 3 years ago
Summary
Older versions of Vim may crash if you compare two floating point numbers using the wrong operator. This means that if you use Vim versions before 9.0.0804, you may experience crashes when working with certain calculations. To stay safe, update to the latest version of Vim.
What to do
- Update debian vim to version 2:9.0.0813-1.
- Update vim vim to version 9.0.0804 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | vim | vim |
< 9.0.0804 cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* |
| Debian:12 | debian | vim |
< 2:9.0.0813-1 Fix: upgrade to 2:9.0.0813-1
|
Original advisory text
Floating Point Comparison with Incorrect Operator in vim/vim
Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
References
- https://huntr.dev/bounties/385a835f-6e33-4d00-acce-ac99f3939143 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4293.j... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-4293 Vendor Advisory
- https://security.gentoo.org/glsa/202305-16 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-4293 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20230203-0007/ Vendor Advisory
- https://github.com/vim/vim/commit/cdef1cefa2a440911c727558562f83ed9b00e16b Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.5
Medium
Type
CWE-1077Floating Point Comparison with Incorrect Operator
CWE-697Incorrect Comparison
Timeline
Published5 Dec 2022
Updated4 Nov 2026
First seen12 Apr 2026
Track software like this
Free during beta