CVE-2022-1620 NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in vim/vim

Medium 6.6 Published 8 May 2022 Updated 8 Oct 2026

Attackers can cause a denial of service via application crash in Vim by providing crafted input to the regular expression engine.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-1620?

CVE-2022-1620 is a medium-severity vulnerability in Apple Macos, published on 8 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.

Weakness: CWE-476

Which versions are affected by CVE-2022-1620?

It affects 3 products.

Products include Apple Macos, Fedoraproject Fedora, Vim Vim.

How do I fix CVE-2022-1620?

Upgrade to a fixed version.

Is CVE-2022-1620 being exploited?

There is no known exploitation of CVE-2022-1620 in the wild and no public exploit code.

All Apple Macos vulnerabilities

Sources

Also known as ALPINE-CVE-2022-1620, AZL-9704, DEBIAN-CVE-2022-1620, GHSA-5fw2-mj64-qv7f, UBUNTU-CVE-2022-1620.