CVE-2022-2889 — Use After Free in vim/vim

Back Back to CVE browser

HIGH

Use After Free in vim/vim

Published Aug 19, 2022

7.8

HIGH

CVSS 3.1

EPSS 0.53%

Description

Use After Free in GitHub repository vim/vim prior to 9.0.0225.

Affected products

Vendor Vim Product Vim/vim Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <9.0.0225

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Vim

Vim/vim

n/a

Version	Status	Constraints
unspecified	affected	<9.0.0225

Red Hat Enterprise Linux 6

vim

Out of support scope
Red Hat Enterprise Linux 7

vim

Out of support scope
Red Hat Enterprise Linux 8

vim

Not affected
Red Hat Enterprise Linux 9

vim

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	vim	Out of support scope	n/a
Red Hat Enterprise Linux 7	vim	Out of support scope	n/a
Red Hat Enterprise Linux 8	vim	Not affected	n/a
Red Hat Enterprise Linux 9	vim	Fix deferred	n/a

Remediation

Red Hat statement

Red Hat Product Security has rated this issue as having a Low security impact because the user has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle & Updates Policy: https://access.redhat.com/support/policy/updates/errata/.

Red Hat mitigation

Do not run untrusted vim scripts as it's not recommended.

Metrics

0.53% 0.00527

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00527

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.53% (0.00527)	42.66th	v5 (v2026.06.15)
Jun 15, 2026	0.50% (0.00496)	38.42th	v5 (v2026.06.15)
Mar 17, 2025	0.04% (0.00038)	8.35th	v4 (v2025.03.14)
Dec 12, 2024	0.11% (0.00109)	45.69th	v3 (v2023.03.01)
Apr 9, 2024	0.09% (0.00091)	38.10th	v3 (v2023.03.01)
Mar 26, 2024	0.08% (0.00076)	31.04th	v3 (v2023.03.01)
Jan 30, 2024	0.06% (0.00062)	24.43th	v3 (v2023.03.01)
Sep 21, 2023	0.06% (0.00056)	21.70th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00050)	17.47th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Feb 23, 2023	0.95% (0.00954)	36.27th	v2 (v2022.01.01)
Dec 30, 2022	1.51% (0.01512)	72.95th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Aug 20, 2022	0.89% (0.00885)	25.98th	v2 (v2022.01.01)

Weaknesses (1)

CWE-416

Use After Free

References (8)

https://access.redhat.com/security/cve/CVE-2022-2889
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2119864
Issue Tracking
https://github.com/vim/vim/commit/91c7cbfe31bbef57d5fcf7d76989fc159f73ef15
PatchThird Party Advisory
https://huntr.dev/bounties/d1ac9817-825d-49ce-b514-1d5b12b6bdaa
ExploitPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/
vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2889
https://security.gentoo.org/glsa/202305-16
vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2022-2889

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-2889		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2119864		Issue Tracking
https://github.com/vim/vim/commit/91c7cbfe31bbef57d5fcf7d76989fc159f73ef15		PatchThird Party Advisory
https://huntr.dev/bounties/d1ac9817-825d-49ce-b514-1d5b12b6bdaa		ExploitPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/		vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2889
https://security.gentoo.org/glsa/202305-16		vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2022-2889