CVE-2022-1674

What it actually does

NULL pointer dereference in vim_regexec_string at regexp.c:2733 causes immediate application crash on crafted regex input.

Why it matters to the business

Vim-based editing, scripting, or build pipelines can be interrupted by application crashes, leading to lost work and operational delays; widespread editor use increases exposure.

How an attack unfolds

An attacker crafts a file containing a malicious regular expression pattern that reaches vim_regexec_string; opening or processing the file triggers the null dereference and forces a crash.

How to fix it

Upgrade vim/vim to commit a59f2dfd0cf9ee1a584d3de5b7c2d47648e79060 or later (corresponding to 8.2.4938). Rebuild or reinstall from the fixed source or updated packages.

How to confirm the fix worked

Verify the installed Vim reports a version at or above 8.2.4938 or contains commit a59f2dfd0cf9ee1a584d3de5b7c2d47648e79060; attempt to open a test file that previously reproduced the crash and confirm the editor no longer terminates.

Typical attack path

1. Prepare a file containing a specially crafted regular expression that triggers the vulnerable code path
2. Open the file with a vulnerable Vim binary (local file or via editor invocation)
3. Vim executes the regex engine and hits the null dereference in vim_regexec_string
4. Application terminates with a segmentation fault or equivalent crash

How to detect it

Review system and application logs for Vim segmentation faults or abrupt terminations around the time users opened untrusted files; correlate with file-access timestamps of recently edited buffers.

What your security team should do

• Immediately update all Vim installations to the fixed commit or version 8.2.4938
• Scan build and CI systems for embedded or vendored Vim binaries and update them
• Add Vim version checks to configuration management and container base images
• Monitor crash reports from developer workstations for unexpected Vim terminations