CVE-2022-3256

HighCVSS 7.8/10Last modified Sep 24, 2026

Description

Use After Free in GitHub repository vim/vim prior to 9.0.0530.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
vim	vim/vim	>= unspecified, < 9.0.0530

References

https://github.com/vim/vim/commit/8ecfa2c56b4992c7f067b92488aa9acea5a454adPatch, Third Party Advisory
https://huntr.dev/bounties/8336a3df-212a-4f8d-ae34-76ef1f936bb3Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00032.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202305-16Third Party Advisory
https://github.com/vim/vim/commit/8ecfa2c56b4992c7f067b92488aa9acea5a454adPatch, Third Party Advisory
https://huntr.dev/bounties/8336a3df-212a-4f8d-ae34-76ef1f936bb3Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00032.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202305-16Third Party Advisory

Timeline

Published: Sep 22, 2022
Last modified: Sep 24, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-325607.5An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings.CVE-2022-325614.9An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insu CVE-2022-325628.8An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission.CVE-2022-325639.8An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate a CVE-2022-325647.5An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie.CVE-2022-325657.5An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids.CVE-2022-325675.4The Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule CVE-2022-325696.7Improper buffer restrictions in BIOS firmware for some Intel(R) NUC M15 Laptop Kits before version BCTGL357.0074 may allow a privileged user CVE-2022-32576.5Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post CVE-2022-325707.8Improper authentication in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enabl CVE-2022-325728.8An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A s CVE-2022-325738.8A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0. A specially-craf