CVE-2022-1620

HIGH 7.5CVE-2022-1620 · Published 08/05/2022 · updated 08/10/2026

In short

CVE-2022-1620 is a HIGH (CVSS 7.5) vulnerability affecting vim (vim).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.9% of all vulnerabilities.
Fix: update to 8.2.4901 or later.

Package	Affected versions	Patched versions
vim vim	`< 8.2.4901`	`8.2.4901`

Description

NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.

References

seclists.org/fulldisclosure/2022/Oct/28
seclists.org/fulldisclosure/2022/Oct/41 · Mailing List
vim/vim commit 8e4b76d · Patch
huntr.dev/bounties/7a4c59f3-fcc0-4496-995d-5ca6acd2da51 · Exploit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6BY5P7ERZS7KXSBCGFCOXLMLGWUUJIH
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIP7KG7TVS5YF3QREAY2GOGUT3YUBZAI
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUN33257RUM4RS2I4GZETKFSAXPETATG
security.gentoo.org/glsa/202208-32 · Third Party Advisory
security.gentoo.org/glsa/202305-16
support.apple.com/kb/HT213488 · Third Party Advisory

More vulnerabilities in vim

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free