CVE-2022-1674 NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in vim/vim

Medium 6.6 Published 12 May 2022 Updated 8 Oct 2026

Attackers can cause a denial of service via application crash in Vim by providing crafted input to the regular expression engine.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-1674?

CVE-2022-1674 is a medium-severity vulnerability in Apple Macos, published on 12 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input.

Weakness: CWE-476

Which versions are affected by CVE-2022-1674?

It affects 3 products.

Products include Apple Macos, Fedoraproject Fedora, Vim Vim.

How do I fix CVE-2022-1674?

Upgrade to a fixed version.

Is CVE-2022-1674 being exploited?

There is no known exploitation of CVE-2022-1674 in the wild and no public exploit code.

All Apple Macos vulnerabilities

Sources

Also known as AZL-9749, DEBIAN-CVE-2022-1674, GHSA-rx8p-hg5g-g9hg, UBUNTU-CVE-2022-1674.