CVE-2022-1381

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

Vendor	Product	Versions
vim	vim/vim	>= unspecified, < 8.2.4763

References

http://seclists.org/fulldisclosure/2022/Oct/28
http://seclists.org/fulldisclosure/2022/Oct/41Mailing List, Release Notes, Third Party Advisory
https://github.com/vim/vim/commit/f50808ed135ab973296bca515ae4029b321afe47Patch, Third Party Advisory
https://huntr.dev/bounties/55f9c0e8-c221-48b6-a00e-bdcaebaba4a4Exploit, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVPZVE2CIE2NGCHZDMEHPBWN3LK2UQAA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6E457NYOIRWBJHKB7ON44UY5AVTG4HU/
https://security.gentoo.org/glsa/202208-32Third Party Advisory
https://security.gentoo.org/glsa/202305-16
https://support.apple.com/kb/HT213488Release Notes, Third Party Advisory
http://seclists.org/fulldisclosure/2022/Oct/28
http://seclists.org/fulldisclosure/2022/Oct/41Mailing List, Release Notes, Third Party Advisory
https://github.com/vim/vim/commit/f50808ed135ab973296bca515ae4029b321afe47Patch, Third Party Advisory
https://huntr.dev/bounties/55f9c0e8-c221-48b6-a00e-bdcaebaba4a4Exploit, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVPZVE2CIE2NGCHZDMEHPBWN3LK2UQAA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6E457NYOIRWBJHKB7ON44UY5AVTG4HU/
https://security.gentoo.org/glsa/202208-32Third Party Advisory
https://security.gentoo.org/glsa/202305-16
https://support.apple.com/kb/HT213488Release Notes, Third Party Advisory

Timeline

Published: Apr 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-13825.5NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, t CVE-2022-13836.1Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the CVE-2022-13848.8Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allow CVE-2022-13854.6Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, wh CVE-2022-13869.8The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to CVE-2022-13874.8The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perfo CVE-2022-13889.8On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior CVE-2022-13894.3On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vu CVE-2022-13909.8The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthe CVE-2022-13919.8The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, whic CVE-2022-13927.5The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could le CVE-2022-13935.4The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle i