CVE-2022-1796 Use After Free in vim/vim
A use-after-free flaw in Vim allows attackers to execute arbitrary code or cause a denial of service via crafted files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1796?
CVE-2022-1796 is a medium-severity use after free vulnerability in Vim Vim, published on 19 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Use After Free in GitHub repository vim/vim prior to 8.2.4979.
Weakness: CWE-416
Which versions are affected by CVE-2022-1796?
It affects 1 product.
Products include Vim Vim.
How do I fix CVE-2022-1796?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2022-1796 being exploited?
There is no known exploitation of CVE-2022-1796 in the wild and no public exploit code.
Other vulnerabilities in Vim Vim
Sources
Also known as ALPINE-CVE-2022-1796, AZL-9791, DEBIAN-CVE-2022-1796, GHSA-3c7c-8h8f-3p6v, UBUNTU-CVE-2022-1796.