What’s Vulnerable › Vulnerabilities

CVE-2022-2849: Heap-based Buffer Overflow in vim/vim

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-08-17 · updated 2026-10-09
• Weakness: CWE-122

Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.

Affected products

• Fedoraproject Fedora: 37
• vim/vim: before 9.0.0220 — fixed in 9.0.0220

How to fix

Upgrade to a fixed version: vim/vim 9.0.0220. Check the vendor advisory for mitigations.

References

• https://github.com/vim/vim/commit/f6d39c31d2177549a986d170e192d8351bd571e2
• https://huntr.dev/bounties/389aeccd-deb9-49ae-9b6a-24c12d79b02e
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
• https://security.gentoo.org/glsa/202305-16
• https://github.com/vim/vim/commit/f6d39c31d2177549a986d170e192d8351bd571e2
• https://huntr.dev/bounties/389aeccd-deb9-49ae-9b6a-24c12d79b02e
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
• https://security.gentoo.org/glsa/202305-16

Get alerted when CVE-2022-2849 or the next vulnerability affects your stack