← Vulnerability feed
Start free
Open in platform
Vulnerability record · CVE-2022-4292 · published 5 December 2022
CVE-2022-4292: Vim use after free vulnerability
Vim · Vim
Use After Free in GitHub repository vim/vim prior to 9.0.0882.
7.8 CVSS 3.1 High EPSS 0.67% · top 49.3% CWE-416 · Use after free
7.8CVSS 3.1 base score
0.67%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
10References, 2 tagged exploit
17 Jun 2026Last modified by NVD
Description
Use After Free in GitHub repository vim/vim prior to 9.0.0882.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/vim/vim/commit/c3d27ada14acd02db357f2d16347acc22cb17e93 | PatchThird Party Advisory |
| https://huntr.dev/bounties/da3d4c47-e57a-451e-993d-9df0ed31f57b | ExploitPatchThird Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYC22GGZ6QA66HLNLHCTAJU | |
| https://security.gentoo.org/glsa/202305-16 | |
| https://security.netapp.com/advisory/ntap-20230113-0005/ | Third Party Advisory |
| https://github.com/vim/vim/commit/c3d27ada14acd02db357f2d16347acc22cb17e93 | PatchThird Party Advisory |
| https://huntr.dev/bounties/da3d4c47-e57a-451e-993d-9df0ed31f57b | ExploitPatchThird Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYC22GGZ6QA66HLNLHCTAJU | |
| https://security.gentoo.org/glsa/202305-16 | |
| https://security.netapp.com/advisory/ntap-20230113-0005/ | Third Party Advisory |
Track CVE-2022-4292 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
9.6CVE-2020-15999FreeType heap buffer overflow in Chrome via crafted HTML pageFreeType contains a heap buffer overflow reachable through a crafted HTML page in Google Chrome prior to 86.0.4240.111. The flaw is an out-of-bounds …KEVEPSS 64%analysed7.8CVE-2023-4911GNU C Library ld.so GLIBC_TUNABLES heap buffer overflowThe GNU C Library dynamic loader ld.so mishandles the GLIBC_TUNABLES environment variable, causing a heap-based buffer overflow and out-of-bounds wri…KEVEPSS 64%analysed7.8CVE-2021-3156Sudo off-by-one heap overflow allows root privilege escalationSudo before 1.9.5p2 contains an off-by-one error leading to a heap-based buffer overflow. Triggering it via 'sudoedit -s' with a command-line argumen…KEVEPSS 100%analysed7.0CVE-2016-5195Linux Kernel Dirty COW Race Condition Privilege EscalationA race condition in the Linux kernel's mm/gup.c mishandles copy-on-write, letting a local user write to read-only memory mappings. This breaks the re…KEVEPSS 84%analysed9.8CVE-2024-21990Netapp ontap select deploy administration utility hard-coded password vulnerabilityONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to vi…EPSS 0.32%9.8CVE-2023-37920Certifi insufficient verification of data authenticity vulnerabilityCertifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts…EPSS 0.57%9.8CVE-2020-20703Vim classic buffer overflow vulnerabilityBuffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter.EPSS 1.5%9.8CVE-2022-3520Vim heap-based buffer overflow vulnerabilityHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.EPSS 1.1%
Source: NIST National Vulnerability Database (record CVE-2022-4292), CISA KEV, FIRST EPSS (scores of 2026-10-10). This page is refreshed as NVD updates the record.
