CVE-2022-1420

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-823 CWE-119

Affected software

Vendor	Product	Versions
vim	vim/vim	>= unspecified, < 8.2.4774

References

http://seclists.org/fulldisclosure/2022/Oct/28
http://seclists.org/fulldisclosure/2022/Oct/41Mailing List, Release Notes, Third Party Advisory
https://github.com/vim/vim/commit/8b91e71441069b1dde9ac9ff9d9a829b1b4aeccaPatch, Third Party Advisory
https://huntr.dev/bounties/a4323ef8-90ea-4e1c-90e9-c778f0ecf326Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVPZVE2CIE2NGCHZDMEHPBWN3LK2UQAA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6E457NYOIRWBJHKB7ON44UY5AVTG4HU/
https://security.gentoo.org/glsa/202208-32Third Party Advisory
https://security.gentoo.org/glsa/202305-16
https://support.apple.com/kb/HT213488Release Notes, Third Party Advisory
http://seclists.org/fulldisclosure/2022/Oct/28
http://seclists.org/fulldisclosure/2022/Oct/41Mailing List, Release Notes, Third Party Advisory
https://github.com/vim/vim/commit/8b91e71441069b1dde9ac9ff9d9a829b1b4aeccaPatch, Third Party Advisory
https://huntr.dev/bounties/a4323ef8-90ea-4e1c-90e9-c778f0ecf326Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVPZVE2CIE2NGCHZDMEHPBWN3LK2UQAA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6E457NYOIRWBJHKB7ON44UY5AVTG4HU/
https://security.gentoo.org/glsa/202208-32Third Party Advisory
https://security.gentoo.org/glsa/202305-16
https://support.apple.com/kb/HT213488Release Notes, Third Party Advisory

Timeline

Published: Apr 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-14214.3The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary CVE-2022-14226.5The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an CVE-2022-14238.8Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions CVE-2022-14246.5The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in us CVE-2022-14254.3The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message CVE-2022-14263.7An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.CVE-2022-14277.8Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if be CVE-2022-14284.3An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions sta CVE-2022-14297.5SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data CVE-2022-14307.5Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0.CVE-2022-14315.3An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9 CVE-2022-14326.4Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0.