CVE-2022-0128

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

vim is vulnerable to Out-of-bounds Read

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
vim	vim/vim	>= unspecified, < 8.2

References

http://seclists.org/fulldisclosure/2022/Jul/14Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/Mar/29Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/35Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/15/1Mailing List, Third Party Advisory
https://github.com/vim/vim/commit/d3a117814d6acbf0dca3eff1a7626843b9b3734aPatch, Third Party Advisory
https://huntr.dev/bounties/63f51299-008a-4112-b85b-1e904aadd4baExploit, Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202208-32Third Party Advisory
https://support.apple.com/kb/HT213183Release Notes, Third Party Advisory
https://support.apple.com/kb/HT213256Third Party Advisory
https://support.apple.com/kb/HT213343Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jul/14Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/Mar/29Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/35Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/15/1Mailing List, Third Party Advisory
https://github.com/vim/vim/commit/d3a117814d6acbf0dca3eff1a7626843b9b3734aPatch, Third Party Advisory
https://huntr.dev/bounties/63f51299-008a-4112-b85b-1e904aadd4baExploit, Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202208-32Third Party Advisory
https://support.apple.com/kb/HT213183Release Notes, Third Party Advisory
https://support.apple.com/kb/HT213256Third Party Advisory
https://support.apple.com/kb/HT213343Third Party Advisory

Timeline

Published: Jan 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-01296.7Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic L CVE-2022-01308.1Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenti CVE-2022-01313.3Jimoty App for Android versions prior to 3.7.42 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key CVE-2022-01327.5peertube is vulnerable to Server-Side Request Forgery (SSRF)CVE-2022-01337.5peertube is vulnerable to Improper Access Control CVE-2022-01348.8The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers CVE-2022-01357.8An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a CVE-2022-01368.1A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF CVE-2022-01375.5A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries.CVE-2022-01387.5MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5 CVE-2022-01399.8Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.CVE-2022-01405.3The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users t