CVE-2022-1160

heap buffer overflow in get_one_sourceline in vim/vim

7.3 HighFix available

heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: Low

Exploit likelihood

1.31%Up 0.4 points since Mar 31, 2022

What each source reports

CVE List Score used 7.3

heap buffer overflow in get_one_sourceline in vim/vim

heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.

Record: CVE-2022-1160
CVSS 3.0: 7.3 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Weakness: CWE-122
Updated: 2026-11-02

EUVDEUVD-2022-24502 7.3

heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.

Record: EUVD-2022-24502
CVSS 3.0: 7.3 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rv49-vpf7-3h48 7.8

heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.

heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.

Record: GHSA-rv49-vpf7-3h48
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-122, CWE-787
Updated: 2026-11-02

NVD 7.8

heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.

Record: CVE-2022-1160
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0: 7.3 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-122, CWE-787
Updated: 2026-11-02

OSVALPINE-CVE-2022-1160 7.8

heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.

Record: ALPINE-CVE-2022-1160
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSVAZL-9211 7.8

CVE-2022-1160 affecting package vim for versions less than 8.2.4743-1

heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.

Record: AZL-9211
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVBELL-CVE-2022-1160 7.8

CVE-2022-1160 does not affect BellSoft software

Record: BELL-CVE-2022-1160
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.3

heap buffer overflow in get_one_sourceline in vim/vim

heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.

Record: CVE-2022-1160
CVSS 3.0: 7.3 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Weakness: CWE-122
Updated: 2026-11-02

OSVMGASA-2022-0203 No score

Updated vim packages fix security vulnerability

vim is vulnerable to out of bounds read (CVE-2022-0213) Heap-based Buffer Overflow in block_insert() in src/ops.c (CVE-2022-0261) a heap-based OOB read of size 1 (CVE-2022-0128) heap-based buffer overflow in utf_head_off() in mbyte.c (CVE-2022-0318) access of memory location before start of buffer (CVE-2022-0351) heap-based buffer overflow in init_ccline() in ex_getln.c (CVE-2022-0359) Stack-based Buffer Overflow in spellsuggest.c (CVE-2022-0408) use after free in src/ex_cmds.c (CVE-2022-0413) out-of-bounds read in delete_buff_tail() in getchar.c (CVE-2022-0393) heap-based-buffer-overflow in ex_retab() of src/indent.c (CVE-2022-0417) heap-use-after-free in enter_buffer() of src/buffer.c (CVE-2022-0443) heap overflow in ex_retab() may lead to crash (CVE-2022-0572) Stack-based Buffer Overflow in vim prior to 8.2. (CVE-2022-0629) NULL Pointer Dereference in vim prior to 8.2 (CVE-2022-0696) buffer overflow (CVE-2022-0714) Use of Out-of-range Pointer Offset (CVE-2022-0729) Use of Out-of-range Pointer Offset in vim (CVE-2022-0685) Use of Out-of-range Pointer Offset in vim (CVE-2022-0554) Heap-based Buffer Overflow occurs in vim (CVE-2022-0943) heap buffer overflow in get_one_sourceline (CVE-2022-1160) use after free in utf_ptr2char (CVE-2022-1154) global heap buffer overflow in skip_range (CVE-2022-1381) Out-of-range Pointer Offset (CVE-2022-1420) heap-buffer-overflow in append_command of src/ex_docmd.c (CVE-2022-1616) heap-buffer-overflow in cmdline_erase_chars of ex_getln.c (CVE-2022-1619) NULL Pointer Dereference in vim_regexec_string() of regexp.c (CVE-2022-1620) heap buffer overflow (CVE-2022-1621) buffer over-read (CVE-2022-1629) NULL pointer dereference in vim_regexec_string() of regexp.c (CVE-2022-1674) a buffer over-read found in scriptfile.c (CVE-2022-1769) Heap-based Buffer Overflow in cindent.c (CVE-2022-1733)

Record: MGASA-2022-0203
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12337-1 No score

gvim-9.0.0453-2.1 on GA media

These are all security issues fixed in the gvim-9.0.0453-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12337-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`vim` Alpine:v3.12	before 8.2.4708-r0	8.2.4708-r0
`vim` Alpine:v3.13	before 8.2.4708-r0	8.2.4708-r0
`vim` Alpine:v3.14	before 8.2.4708-r0	8.2.4708-r0
`vim` Alpine:v3.15	before 8.2.4708-r0	8.2.4708-r0
`vim` Alpine:v3.16	before 8.2.4708-r0	8.2.4708-r0
`vim` Alpine:v3.17	before 8.2.4708-r0	8.2.4708-r0
`vim` Alpine:v3.18	before 8.2.4708-r0	8.2.4708-r0
`vim` Alpine:v3.19	before 8.2.4708-r0	8.2.4708-r0
`vim` Alpine:v3.20	before 8.2.4708-r0	8.2.4708-r0
`vim` Alpine:v3.21	before 8.2.4708-r0	8.2.4708-r0

Show 6 moreShow less

Affected packages
Package	Affected	Fixed
`vim` Alpine:v3.22	before 8.2.4708-r0	8.2.4708-r0
`vim` Alpine:v3.23	before 8.2.4708-r0	8.2.4708-r0
`vim` Alpine:v3.24	before 8.2.4708-r0	8.2.4708-r0
`vim` Azure Linux:2	before 8.2.4743-1	8.2.4743-1
`vim` Mageia:8 From an advisory covering 31 CVEs	before 8.2.4975-1.mga8	8.2.4975-1.mga8
`vim` openSUSE:Tumbleweed From an advisory covering 84 CVEs	before 9.0.0453-2.1	9.0.0453-2.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-1160 is a high vulnerability (CVSS 7.3) in Vim, published March 30, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in vim 8.2.4708-r0.

References

Show 111 moreShow less