{"id":"CVE-2022-3256","aliases":["ALPINE-CVE-2022-3256","AZL-11003","BELL-CVE-2022-3256","CLSA-2022-1664475299","CLSA-2022-1664475636","CLSA-2022-1664476383","CLSA-2026-1778602862","CLSA-2026-1779356802","DEBIAN-CVE-2022-3256","DLA-3204-1","EUVD-2022-42659","GHSA-cfw9-4m3h-gp62","MGASA-2022-0430","OESA-2022-1975","UBUNTU-CVE-2022-3256","USN-5775-1","USN-6420-1"],"status":"published","title":"Use After Free in vim/vim","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0530.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00489,"percentile":0.42373,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2022-09-22T00:00:00Z","modified":"2026-11-03T08:01:49Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"vim","fixed_in":["9.0.0598-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"vim","fixed_in":["9.0.0598-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"vim","fixed_in":["9.0.0598-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"vim","fixed_in":["9.0.0598-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"vim","fixed_in":["9.0.0598-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"vim","fixed_in":["9.0.0598-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"vim","fixed_in":["9.0.0598-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vim","fixed_in":["9.0.0598-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"vim","fixed_in":["9.0.0614-1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-common","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-doc","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gui-common","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-runtime","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-tiny","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els31"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-X11","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els30"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-common","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els30"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-enhanced","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els30"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-filesystem","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els30"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-minimal","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els30"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-X11","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els30"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-common","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els30"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-enhanced","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els30"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-filesystem","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els30"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-minimal","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els30"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"vim","fixed_in":["2:9.0.0626-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vim","fixed_in":["2:9.0.0626-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vim","fixed_in":["2:9.0.0626-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","fixed_in":["2:7.4.052-1ubuntu3.1+esm13"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","fixed_in":["2:7.4.1689-3ubuntu1.5+esm14"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","fixed_in":["2:8.0.1453-1ubuntu1.13+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"vim","fixed_in":["2:8.1.2269-1ubuntu5.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"vim","fixed_in":["2:8.2.3995-1ubuntu2.12"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0598-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0598-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0598-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0598-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0598-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0598-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0598-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0598-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0614-1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gui-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els31"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els30"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els30"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els30"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els30"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els30"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els30"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els30"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els30"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els30"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els30"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_2.1.tuxcare.els21"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"bundled":21},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"bundled":21},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"bundled":21},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"bundled":21},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els14"}]}],"bundled":21},{"source":"osv","ecosystem":"Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.0626-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.0626-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.0626-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u4"}]}],"versions":["2:8.1.0875-5","2:8.1.0875-5+deb10u1","2:8.1.0875-5+deb10u2","2:8.1.0875-5+deb10u3"],"bundled":14},{"source":"osv","ecosystem":"Mageia:8","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.828-1.mga8"}]}],"bundled":56},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2-58.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2-58.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2-67.oe2203"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm13"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3","2:7.4.052-1ubuntu3.1+esm4","2:7.4.052-1ubuntu3.1+esm5","2:7.4.052-1ubuntu3.1+esm6","2:7.4.052-1ubuntu3.1+esm7","2:7.4.052-1ubuntu3.1+esm8","2:7.4.052-1ubuntu3.1+esm9","2:7.4.052-1ubuntu3.1+esm10","2:7.4.052-1ubuntu3.1+esm11","2:7.4.052-1ubuntu3.1+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm14"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2","2:7.4.1689-3ubuntu1.5+esm3","2:7.4.1689-3ubuntu1.5+esm4","2:7.4.1689-3ubuntu1.5+esm5","2:7.4.1689-3ubuntu1.5+esm6","2:7.4.1689-3ubuntu1.5+esm7","2:7.4.1689-3ubuntu1.5+esm8","2:7.4.1689-3ubuntu1.5+esm10","2:7.4.1689-3ubuntu1.5+esm11","2:7.4.1689-3ubuntu1.5+esm12","2:7.4.1689-3ubuntu1.5+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm5"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9","2:8.0.1453-1ubuntu1.10","2:8.0.1453-1ubuntu1.11","2:8.0.1453-1ubuntu1.12","2:8.0.1453-1ubuntu1.13","2:8.0.1453-1ubuntu1.13+esm1","2:8.0.1453-1ubuntu1.13+esm3","2:8.0.1453-1ubuntu1.13+esm4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.18"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9","2:8.1.2269-1ubuntu5.11","2:8.1.2269-1ubuntu5.12","2:8.1.2269-1ubuntu5.13","2:8.1.2269-1ubuntu5.14","2:8.1.2269-1ubuntu5.15","2:8.1.2269-1ubuntu5.16","2:8.1.2269-1ubuntu5.17"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.12"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm14"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2","2:7.4.1689-3ubuntu1.5+esm3","2:7.4.1689-3ubuntu1.5+esm4","2:7.4.1689-3ubuntu1.5+esm5","2:7.4.1689-3ubuntu1.5+esm6","2:7.4.1689-3ubuntu1.5+esm7","2:7.4.1689-3ubuntu1.5+esm8","2:7.4.1689-3ubuntu1.5+esm10","2:7.4.1689-3ubuntu1.5+esm11","2:7.4.1689-3ubuntu1.5+esm12","2:7.4.1689-3ubuntu1.5+esm13"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm13"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3","2:7.4.052-1ubuntu3.1+esm4","2:7.4.052-1ubuntu3.1+esm5","2:7.4.052-1ubuntu3.1+esm6","2:7.4.052-1ubuntu3.1+esm7","2:7.4.052-1ubuntu3.1+esm8","2:7.4.052-1ubuntu3.1+esm9","2:7.4.052-1ubuntu3.1+esm10","2:7.4.052-1ubuntu3.1+esm11","2:7.4.052-1ubuntu3.1+esm12"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm5"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9","2:8.0.1453-1ubuntu1.10","2:8.0.1453-1ubuntu1.11","2:8.0.1453-1ubuntu1.12","2:8.0.1453-1ubuntu1.13","2:8.0.1453-1ubuntu1.13+esm1","2:8.0.1453-1ubuntu1.13+esm3","2:8.0.1453-1ubuntu1.13+esm4"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.18"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9","2:8.1.2269-1ubuntu5.11","2:8.1.2269-1ubuntu5.12","2:8.1.2269-1ubuntu5.13","2:8.1.2269-1ubuntu5.14","2:8.1.2269-1ubuntu5.15","2:8.1.2269-1ubuntu5.16","2:8.1.2269-1ubuntu5.17"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.12"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11"],"bundled":13}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"neovim","product":"neovim"},{"vendor":"vim","product":"vim"},{"vendor":"vim","product":"vim/vim"}],"references":[{"url":"https://huntr.dev/bounties/8336a3df-212a-4f8d-ae34-76ef1f936bb3","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/vim/vim/commit/8ecfa2c56b4992c7f067b92488aa9acea5a454ad","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://security.gentoo.org/glsa/202305-16","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3256","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI"},{"url":"https://github.com/advisories/GHSA-cfw9-4m3h-gp62"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-3256","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-3256","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1664475299","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1664475636.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1664476383.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778602862.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1779356802.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3256.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3256","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0430.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30561","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4JJNUS4AEVYSEJMCK6JZB57QHD5V2G4O/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-3053","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5492-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RY3GEN2Q46ZJKSNHTN2XB6B3VAJBEILN/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-September/012199.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JUQDO2AKYFBQGJNMY6TUKLRL7L6M3NZB/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4JCW33NOLMELTTTDJH7WGDIFJZ5YEEMK/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-3182","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1975","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3235","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-3256","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5775-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6420-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3591","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4293","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-3256","title":"Use After Free in vim/vim","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0530.","status":"published","published":"2022-09-22T00:00:00Z","modified":"2025-05-23T20:31:50.981Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42659","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0530.","status":"published","published":"2022-09-22T00:00:00Z","modified":"2025-05-23T20:31:50Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:38.869898Z"}],"ghsa":[{"id":"GHSA-cfw9-4m3h-gp62","title":"Use After Free in GitHub repository vim/vim prior to 9.0.0530.","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0530.","status":"published","published":"2022-09-23T00:00:41Z","modified":"2026-09-24T18:32:06Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:12:23.588673Z"}],"nvd":[{"id":"CVE-2022-3256","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0530.","status":"published","published":"2022-09-22T13:15:09.133Z","modified":"2026-09-24T15:54:01.663Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:28.501364Z"}],"osv":[{"id":"ALPINE-CVE-2022-3256","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0530.","status":"published","published":"2022-09-22T13:15:09.133Z","modified":"2026-11-03T07:31:17.540577197Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"AZL-11003","title":"CVE-2022-3256 affecting package vim for versions less than 9.0.0614-1","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0530.","status":"published","published":"2022-09-22T13:15:09Z","modified":"2026-04-21T04:21:45.291625Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"BELL-CVE-2022-3256","title":"CVE-2022-3256 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:08.42879Z","modified":"2026-01-26T09:48:11.127963Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-3256","title":"Use After Free in vim/vim","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0530.","status":"published","published":"2022-09-22T00:00:00Z","modified":"2026-10-28T10:29:17.583084718Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"DEBIAN-CVE-2022-3256","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0530.","status":"published","published":"2022-09-22T13:15:09.133Z","modified":"2026-11-03T08:01:49.905294956Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"OESA-2022-1975","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\r\n\r\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.(CVE-2022-3234)\r\n\r\nUse After Free in GitHub repository vim/vim prior to 9.0.0490.(CVE-2022-3235)\r\n\r\nUse After Free in GitHub repository vim/vim prior to 9.0.0530.(CVE-2022-3256)","status":"published","published":"2022-09-30T11:05:17Z","modified":"2026-08-18T01:17:18.641504494Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-3256","description":"Use After Free in GitHub repository vim/vim prior to 9.0.0530.","status":"published","published":"2022-09-22T13:15:00Z","modified":"2026-02-04T03:51:18.748262Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CLSA-2022-1664475299","title":"Fix CVE(s): CVE-2022-3256","description":"\n   * SECURITY_UPDATE: Using freed memory when autocmd changes mark\n     - debian/patches/CVE-2022-3256.patch: Copy the mark before\n     editing another buffer\n     - CVE-2022-3256","status":"published","published":"2022-09-29T18:14:59Z","modified":"2026-06-04T10:04:05.323569Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1664475636","title":"Fixed CVE-2022-3256 in vim","description":"- CVE-2022-3256: copy the mark before editing another buffer","status":"published","published":"2022-09-29T18:20:36Z","modified":"2026-06-01T00:32:44.902313137Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1664476383","title":"Fixed CVE-2022-3256 in vim","description":"- CVE-2022-3256: copy the mark before editing another buffer","status":"published","published":"2022-09-29T18:33:03Z","modified":"2026-06-01T00:33:15.793283784Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2026-1778602862","title":"vim: Fix of 4 CVEs","description":"- CVE-2022-2175: fix invalid memory access in cmdline_insert_reg() when\n  using an expression on the command line; save/restore new_cmdpos around\n  the expression evaluation (ex_getln.c, upstream patch 8.2.5148; hunk 3\n  context adjusted for 8.2.2637)\n- CVE-2022-3256: fix use-after-free in movemark() when an autocommand\n  changes the mark; make a local copy of the fmark before potentially\n  triggering buffer autocommands (mark.c, upstream patch 9.0.0530)\n- CVE-2022-4292: fix use-after-free in did_set_spelllang() when a\n  SpellFileMissing autocommand uses :bwipe to close the current window;\n  also bail out when the window is no longer valid (spell.c, upstream\n  patch 9.0.0882)\n- CVE-2022-3324: fix negative-index buffer access caused by negative\n  window width; clamp next_curwin_size in win_equal_rec() and clamp\n  wp-\u003ew_width in win_new_width() (window.c, upstream patch 9.0.0598)","status":"published","published":"2026-05-12T16:21:08Z","modified":"2026-10-21T10:45:35.618107596Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779356802","title":"vim: Fix of 21 CVEs","description":"- CVE-2022-0572: heap overflow on vcol-overflow in :retab (upstream vim 8.2.4359)\n- CVE-2022-0368: illegal memory access when undo makes Visual area invalid (upstream vim 8.2.4217)\n- CVE-2022-0685: crash on multi-byte char in unix_expandpath() (upstream vim 8.2.4418)\n- CVE-2022-2125: heap overflow in get_lisp_indent() (upstream vim 8.2.5122)\n- CVE-2022-2183: reading past end-of-line in lisp indenting (upstream vim 8.2.5151)\n- CVE-2022-2124: reading past end-of-line in current_quote() (upstream vim 8.2.5120)\n- CVE-2022-2344: heap overflow in ins_compl_add() (upstream vim 9.0.0046)\n- CVE-2022-3256: use-after-free in movemark() when autocmd changes mark (upstream vim 9.0.0530)\n- CVE-2023-4752: heap use-after-free in ins_compl_get_exp() (upstream vim 9.0.1858)\n- CVE-2022-2126: spell-suggest read past bad word (upstream vim 8.2.5123)\n- CVE-2022-2946: use-after-free in do_tag() when tagfunc invalidates tagstack (upstream vim 9.0.0246)\n- CVE-2022-1720: OOB read in get_visual_text() (upstream vim 8.2.4956)\n- CVE-2022-3234: OOB write in op_replace() (upstream vim 9.0.0483)\n- CVE-2023-0433: same_leader() read past end-of-line on short comment line (upstream vim 9.0.1225)\n- CVE-2023-4781: heap-buffer-overflow in vim_regsub_both() via nmatch underflow in :substitute, plus textlock guard in win_exchange() (upstream vim 9.0.1873)\n- CVE-2022-0351: crash on deeply nested expression (upstream vim 8.2.4206)\n- CVE-2022-2175: new_cmdpos leak across register insertion in getcmdline() (upstream vim 8.2.5148)\n- CVE-2026-39881: netbeans command injection via crafted sign/highlight identifier + special-keys (upstream vim 9.2.0316)\n- CVE-2021-4166: heap-buffer-overflow when clearing the argument list while it is being used (upstream vim 8.2.3884, with 8.2.2421 + 8.2.2463 prereqs for arglist_locked plumbing)\n- CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)\n- CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)","status":"published","published":"2026-05-21T09:46:46Z","modified":"2026-10-21T10:47:11.254162783Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"DLA-3204-1","title":"vim - security update","status":"published","published":"2022-11-24T00:00:00Z","modified":"2026-03-09T01:20:23.095639Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2022-0430","title":"Updated vim packages fix security vulnerability","description":"Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.\n(CVE-2022-2000, CVE-2022-2129, CVE-2022-2210)\n\nUse After Free in GitHub repository vim/vim prior to 8.2. (CVE-2022-2042)\n\nBuffer Over-read in GitHub repository vim/vim prior to 8.2.\n(CVE-2022-2124, CVE-2022-2175)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.\n(CVE-2022-2125, CVE-2022-2182, CVE-2022-2207)\n\nOut-of-bounds Read in GitHub repository vim/vim prior to 8.2.\n(CVE-2022-2126, CVE-2022-2183, CVE-2022-2206)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.\n(CVE-2022-2208)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.\n(CVE-2022-2231)\n\nOut-of-bounds Read in GitHub repository vim/vim prior to 9.0.\n(CVE-2022-2257, CVE-2022-2286, CVE-2022-2287, CVE-2022-2288)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.\n(CVE-2022-2264, CVE-2022-2284)\n\nInteger Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.\n(CVE-2022-2285)\n\nUse After Free in GitHub repository vim/vim prior to 9.0. (CVE-2022-2289)\n\nStack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.\n(CVE-2022-2304)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.\n(CVE-2022-2343)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.\n(CVE-2022-2344)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0046.\n(CVE-2022-2345)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.\n(CVE-2022-2522)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.\n(CVE-2022-2571)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102.\n(CVE-2022-2580)\n\nOut-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.\n(CVE-2022-2581)\n\nUndefined Behavior for Input to API in GitHub repository vim/vim prior to\n9.0.0100. (CVE-2022-2598)\n\nOut-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.\n(CVE-2022-2816)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0213.\n(CVE-2022-2817)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.\n(CVE-2022-2819)\n\nBuffer Over-read in GitHub repository vim/vim prior to 9.0.0218.\n(CVE-2022-2845)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.\n(CVE-2022-2849)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0221.\n(CVE-2022-2862)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.\n(CVE-2022-2874)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0225.\n(CVE-2022-2889)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240.\n(CVE-2022-2923)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0246.\n(CVE-2022-2946)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259.\n(CVE-2022-2980)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0260.\n(CVE-2022-2982)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0286.\n(CVE-2022-3016)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0322.\n(CVE-2022-3037)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0360.\n(CVE-2022-3099)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0389.\n(CVE-2022-3134)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.\n(CVE-2022-3234)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0490.\n(CVE-2022-3235)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0530.\n(CVE-2022-3256)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.\n(CVE-2022-3278)\n\nStack-based Buffer Overflow in GitHub repository vim/vim prior to\n9.0.0577. (CVE-2022-3296)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0579.\n(CVE-2022-3297)\n\nStack-based Buffer Overflow in GitHub repository vim/vim prior to\n9.0.0598. (CVE-2022-3324)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0614.\n(CVE-2022-3352)\n\nAffected by this issue is the function qf_update_buffer of the file\nquickfix.c of the component autocmd Handler. The manipulation leads to use\nafter free. The attack may be launched remotely. (CVE-2022-3705)\n","status":"published","published":"2022-11-18T22:50:51Z","modified":"2026-04-16T04:42:28.202864031Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-5775-1","title":"vim vulnerabilities","description":"It was discovered that Vim uses freed memory in recurisve substitution of\nspecially crafted patterns. An attacker could possbly use this to crash Vim\nand cause denial of service. (CVE-2022-2345)\n\nIt was discovered that Vim makes illegal memory calls when patterns start\nwith an illegal byte. An attacker could possibly use this to crash Vim,\naccess or modify memory, or execute arbitrary commands. (CVE-2022-2581)\n\nIt was discovered that Vim could be made to crash when parsing invalid line\nnumbers. An attacker could possbly use this to crash Vim and cause denial\nof service. (CVE-2022-3099)\n\nIt was discovered that Vim uses freed memory when autocmd changes a mark.\nAn attacker could possbly use this to crash Vim and cause denial of\nservice. (CVE-2022-3256)\n\nIt was discovered the Vim uses an incorrect array index when window width\nis negative. A local attacker could possbly use this to crash Vim and cause\ndenial of service. (CVE-2022-3324)\n\nIt was discoverd that certain buffers could be sent to the wrong window. An\nattacker with local access could use this to send messages to the wrong\nwindow. (CVE-2022-3591)\n","status":"published","published":"2022-12-12T22:32:53Z","modified":"2026-06-25T13:31:39.07117741Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-6420-1","title":"vim vulnerabilities","description":"It was discovered that Vim incorrectly handled memory when opening certain\nfiles. If an attacker could trick a user into opening a specially crafted\nfile, it could cause Vim to crash, or possibly execute arbitrary code. This\nissue only affected Ubuntu 22.04 LTS. (CVE-2022-3235, CVE-2022-3278,\nCVE-2022-3297, CVE-2022-3491)\n\nIt was discovered that Vim incorrectly handled memory when opening certain\nfiles. If an attacker could trick a user into opening a specially crafted\nfile, it could cause Vim to crash, or possibly execute arbitrary code. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04\nLTS. (CVE-2022-3352, CVE-2022-4292)\n\nIt was discovered that Vim incorrectly handled memory when replacing in\nvirtualedit mode. An attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, and Ubuntu 22.04 LTS. (CVE-2022-3234)\n\nIt was discovered that Vim incorrectly handled memory when autocmd changes\nmark. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2022-3256)\n\nIt was discovered that Vim did not properly perform checks on array index\nwith negative width window. An attacker could possibly use this issue to\ncause a denial of service, or execute arbitrary code. (CVE-2022-3324)\n\nIt was discovered that Vim did not properly perform checks on a put command\ncolumn with a visual block. An attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 20.04 LTS, and\nUbuntu 22.04 LTS. (CVE-2022-3520)\n\nIt was discovered that Vim incorrectly handled memory when using autocommand\nto open a window. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2022-3591)\n\nIt was discovered that Vim incorrectly handled memory when updating buffer\nof the component autocmd handler. An attacker could possibly use this issue\nto cause a denial of service. This issue only affected Ubuntu 20.04 LTS,\nand Ubuntu 22.04 LTS. (CVE-2022-3705)\n\nIt was discovered that Vim incorrectly handled floating point comparison\nwith incorrect operator. An attacker could possibly use this issue to cause\na denial of service. This issue only affected Ubuntu 20.04 LTS. and Ubuntu\n22.04 LTS. (CVE-2022-4293)\n","status":"published","published":"2023-10-09T04:10:20Z","modified":"2026-06-29T13:50:58.697079586Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}