CVE-2022-4141

Name of the Vulnerable Software and Affected Versions vim versions 9.0.0946 and below

Description The issue is related to a heap-based buffer overflow in the vim text editor, which can be exploited by an attacker to gain access to confidential data, compromise data integrity, and cause a denial of service. This can occur when an attacker uses CTRL-W gf in the expression used in the RHS of the substitute command. The exploitation of this issue may result in heap corruption, including buffer overflows and use-after-free situations, which are generally considered exploitable.

Recommendations For vim versions 9.0.0946 and below, consider disabling the substitute command or restricting the use of CTRL-W gf in the expression used in the RHS of the substitute command as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.