CVE-2022-2287: vim vim – CVSS 7.1 · Watchpost

← All vulnerabilities

CVE-2022-2287

HIGH 7.1CVE-2022-2287 · Published 02/07/2022 · updated 08/10/2026

In short

CVE-2022-2287 is a HIGH (CVSS 7.1) vulnerability affecting vim (vim).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.3% of all vulnerabilities.
Fix: update to 9.0.0021 or later.

Package	Affected versions	Patched versions
vim vim	`< 9.0.0021`	`9.0.0021`

Description

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

References

vim/vim commit 5e59ea5 · Patch
huntr.dev/bounties/654aa069-3a9d-45d3-9a52-c1cf3490c284 · Exploit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK
security.gentoo.org/glsa/202208-32 · Third Party Advisory
security.gentoo.org/glsa/202305-16

More vulnerabilities in vim

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free