{"id":"CVE-2022-3491","aliases":["DEBIAN-CVE-2022-3491","EUVD-2022-42863","GHSA-7g7x-hhf5-323c","OESA-2022-2135","SUSE-SU-2022:4631-1","SUSE-SU-2023:0209-1","UBUNTU-CVE-2022-3491","USN-6420-1"],"status":"published","title":"Heap-based Buffer Overflow in vim/vim","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.","severity":{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00525,"percentile":0.44818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-787"],"published":"2022-12-03T00:00:00Z","modified":"2026-11-03T06:02:38Z","fixes":[{"ecosystem":"Debian:12","package":"vim","fixed_in":["2:9.0.0813-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vim","fixed_in":["2:9.0.0813-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vim","fixed_in":["2:9.0.0813-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"vim","fixed_in":["2:8.2.3995-1ubuntu2.12"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.0813-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.0813-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.0813-1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-3.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-3.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-4.oe2203"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1040-150000.5.31.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1234-17.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1234-17.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1234-17.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1234-17.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1234-17.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1234-17.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1234-17.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.12"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm13"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3","2:7.4.052-1ubuntu3.1+esm4","2:7.4.052-1ubuntu3.1+esm5","2:7.4.052-1ubuntu3.1+esm6","2:7.4.052-1ubuntu3.1+esm7","2:7.4.052-1ubuntu3.1+esm8","2:7.4.052-1ubuntu3.1+esm9","2:7.4.052-1ubuntu3.1+esm10","2:7.4.052-1ubuntu3.1+esm11","2:7.4.052-1ubuntu3.1+esm12"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm5"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9","2:8.0.1453-1ubuntu1.10","2:8.0.1453-1ubuntu1.11","2:8.0.1453-1ubuntu1.12","2:8.0.1453-1ubuntu1.13","2:8.0.1453-1ubuntu1.13+esm1","2:8.0.1453-1ubuntu1.13+esm3","2:8.0.1453-1ubuntu1.13+esm4"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.18"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9","2:8.1.2269-1ubuntu5.11","2:8.1.2269-1ubuntu5.12","2:8.1.2269-1ubuntu5.13","2:8.1.2269-1ubuntu5.14","2:8.1.2269-1ubuntu5.15","2:8.1.2269-1ubuntu5.16","2:8.1.2269-1ubuntu5.17"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.12"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11"],"bundled":13}],"products":[{"vendor":"vim","product":"vim"},{"vendor":"vim","product":"vim/vim"}],"references":[{"url":"https://huntr.dev/bounties/6e6e05c2-2cf7-4aa5-a817-a62007bf92cb","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/vim/vim/commit/3558afe9e9e904cabb8475392d859f2d2fc21041","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/202305-16","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3491","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7g7x-hhf5-323c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3491.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3491","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3591","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3520","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224631-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204779","tags":["report"]},{"url":"https://bugzilla.suse.com/1205797","tags":["report"]},{"url":"https://bugzilla.suse.com/1206028","tags":["report"]},{"url":"https://bugzilla.suse.com/1206071","tags":["report"]},{"url":"https://bugzilla.suse.com/1206072","tags":["report"]},{"url":"https://bugzilla.suse.com/1206075","tags":["report"]},{"url":"https://bugzilla.suse.com/1206077","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4293","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230209-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206866","tags":["report"]},{"url":"https://bugzilla.suse.com/1206867","tags":["report"]},{"url":"https://bugzilla.suse.com/1206868","tags":["report"]},{"url":"https://bugzilla.suse.com/1207162","tags":["report"]},{"url":"https://bugzilla.suse.com/1207396","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0433","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-3491","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6420-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3591","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4293","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-3491","title":"Heap-based Buffer Overflow in vim/vim","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.","status":"published","published":"2022-12-03T00:00:00Z","modified":"2025-04-23T18:26:52.197Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:34:33.574107Z"}],"euvd":[{"id":"EUVD-2022-42863","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.","status":"published","published":"2022-12-03T00:00:00Z","modified":"2025-04-23T18:26:52Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:08.95736Z"}],"ghsa":[{"id":"GHSA-7g7x-hhf5-323c","title":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.","status":"published","published":"2022-12-03T15:30:28Z","modified":"2023-05-03T12:30:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T14:54:34.500941Z"}],"nvd":[{"id":"CVE-2022-3491","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.","status":"published","published":"2022-12-03T13:15:09.713Z","modified":"2026-06-17T04:59:37.767Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"CVE-2022-3491","title":"Heap-based Buffer Overflow in vim/vim","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.","status":"published","published":"2022-12-03T00:00:00Z","modified":"2026-10-28T10:27:00.051668294Z","cvss":[{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"OESA-2022-2135","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing.It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\r\n\r\nHeap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.(CVE-2022-4141)\r\n\r\nUse After Free in GitHub repository vim/vim prior to 9.0.0789.(CVE-2022-3591)\r\n\r\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.(CVE-2022-3520)\r\n\r\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.(CVE-2022-3491)","status":"published","published":"2022-12-09T11:05:27Z","modified":"2026-08-18T01:17:28.297470784Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2022-3491","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.","status":"published","published":"2022-12-03T13:15:00Z","modified":"2026-02-04T03:46:26.147438Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"DEBIAN-CVE-2022-3491","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.","status":"published","published":"2022-12-03T13:15:09.713Z","modified":"2026-11-03T06:02:38.034090587Z","updated_at":"2026-11-03T06:43:43.638289Z"},{"id":"SUSE-SU-2022:4631-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\nUpdated to version 9.0.1040:\n\n- CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 (bsc#1206028).\n- CVE-2022-3520: vim: Heap-based Buffer Overflow (bsc#1206071).\n- CVE-2022-3591: vim: Use After Free (bsc#1206072).\n- CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882 (bsc#1206075).\n- CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804 (bsc#1206077).\n- CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 (bsc#1205797).\n- CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c (bsc#1204779).\n","status":"published","published":"2022-12-28T08:29:39Z","modified":"2026-02-04T03:51:10.273003Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0209-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- Updated to version 9.0.1234:\n  - CVE-2023-0433: Fixed an out of bounds memory access that could\n    cause a crash (bsc#1207396).\n  - CVE-2023-0288: Fixed an out of bounds memory access that could\n    cause a crash (bsc#1207162).\n  - CVE-2023-0054: Fixed an out of bounds memory write that could\n    cause a crash or memory corruption (bsc#1206868).\n  - CVE-2023-0051: Fixed an out of bounds memory access that could\n    cause a crash (bsc#1206867).\n  - CVE-2023-0049: Fixed an out of bounds memory access that could\n    cause a crash (bsc#1206866).\n  - CVE-2022-3491: Fixed an out of bounds memory access that could\n    cause a crash (bsc#1206028).\n  - CVE-2022-3520: Fixed an out of bounds memory access that could\n    cause a crash (bsc#1206071).\n  - CVE-2022-3591: Fixed a use-after-free issue that could cause\n    memory corruption or undefined behavior (bsc#1206072).\n  - CVE-2022-4292: Fixed a use-after-free issue that could cause\n    memory corruption or undefined behavior (bsc#1206075).\n  - CVE-2022-4293: Fixed a floating point exception that could cause\n    a crash (bsc#1206077).\n  - CVE-2022-4141: Fixed an out of bounds memory write that could\n    cause a crash or memory corruption (bsc#1205797).\n  - CVE-2022-3705: Fixed an use-after-free issue that could cause\n    a crash or memory corruption (bsc#1204779).\n","status":"published","published":"2023-01-30T16:25:05Z","modified":"2026-02-04T02:38:15.606228Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-6420-1","title":"vim vulnerabilities","description":"It was discovered that Vim incorrectly handled memory when opening certain\nfiles. If an attacker could trick a user into opening a specially crafted\nfile, it could cause Vim to crash, or possibly execute arbitrary code. This\nissue only affected Ubuntu 22.04 LTS. (CVE-2022-3235, CVE-2022-3278,\nCVE-2022-3297, CVE-2022-3491)\n\nIt was discovered that Vim incorrectly handled memory when opening certain\nfiles. If an attacker could trick a user into opening a specially crafted\nfile, it could cause Vim to crash, or possibly execute arbitrary code. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04\nLTS. (CVE-2022-3352, CVE-2022-4292)\n\nIt was discovered that Vim incorrectly handled memory when replacing in\nvirtualedit mode. An attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, and Ubuntu 22.04 LTS. (CVE-2022-3234)\n\nIt was discovered that Vim incorrectly handled memory when autocmd changes\nmark. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2022-3256)\n\nIt was discovered that Vim did not properly perform checks on array index\nwith negative width window. An attacker could possibly use this issue to\ncause a denial of service, or execute arbitrary code. (CVE-2022-3324)\n\nIt was discovered that Vim did not properly perform checks on a put command\ncolumn with a visual block. An attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 20.04 LTS, and\nUbuntu 22.04 LTS. (CVE-2022-3520)\n\nIt was discovered that Vim incorrectly handled memory when using autocommand\nto open a window. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2022-3591)\n\nIt was discovered that Vim incorrectly handled memory when updating buffer\nof the component autocmd handler. An attacker could possibly use this issue\nto cause a denial of service. This issue only affected Ubuntu 20.04 LTS,\nand Ubuntu 22.04 LTS. (CVE-2022-3705)\n\nIt was discovered that Vim incorrectly handled floating point comparison\nwith incorrect operator. An attacker could possibly use this issue to cause\na denial of service. This issue only affected Ubuntu 20.04 LTS. and Ubuntu\n22.04 LTS. (CVE-2022-4293)\n","status":"published","published":"2023-10-09T04:10:20Z","modified":"2026-06-29T13:50:58.697079586Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}