No exploitation reportedFix available

CVE-2022-1381

Q: Is CVE-2022-1381 actively exploited?

Active exploitation of CVE-2022-1381 has not been confirmed. Its EPSS score was 3.1% on 2026-11-08, the estimated probability of exploitation in the next 30 days.

Q: What is the CVSS score for CVE-2022-1381?

CVE-2022-1381 has a CVSS v3 base score of 7.8 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

No exploitation reported by the sources we read.

Published2022-04-18
Fixed in8.2.4763
WeaknessCWE-122 · CWE-787

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

Timeline

dates in UTC

2022-04-1801:15CVE publishedNVD

Versions per branch

NVD

Vim

Branch	Affected	Fixed in	Source
8.2	< 8.2.4763	8.2.4763	NVD

Fedoraproject fedora

Branch	Affected	Fixed in	Source
34.x	= 34	no fix published	NVD
35.x	= 35	no fix published	NVD
36.x	= 36	no fix published	NVD

Apple macos

Branch	Affected	Fixed in	Source
13.0	< 13.0	13.0	NVD

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

vimSUSE:OpenStack Cloud Crowbar 9all versions · fixed in 9.0.0814-17.9.1
vimSUSE:OpenStack Cloud 9all versions · fixed in 9.0.0814-17.9.1
vimSUSE:Manager Server 4.1all versions · fixed in 8.2.5038-150000.5.21.1
vimSUSE:Manager Retail Branch Server 4.1all versions · fixed in 8.2.5038-150000.5.21.1
vimSUSE:Manager Proxy 4.1all versions · fixed in 8.2.5038-150000.5.21.1
vimSUSE:Linux Enterprise Server for SAP Applications 15 SP2all versions · fixed in 8.2.5038-150000.5.21.1
vimSUSE:Linux Enterprise Server for SAP Applications 15 SP1all versions · fixed in 8.2.5038-150000.5.21.1
vimSUSE:Linux Enterprise Server for SAP Applications 15all versions · fixed in 8.2.5038-150000.5.21.1

47 more package ranges on OSV.dev

Vendor advisories

CVE-2022-1381 Red Hat Product Security
vim: global heap buffer overflow in skip_range

Full record on NVD

Fix

Update Vim to 8.2.4763

Advisories and patches

seclists.orgRelease Notes
github.comPatch
huntr.devPatch
support.apple.comRelease Notes

Detection

Nuclei template: none so far
Exploit-DB: no entry
Proof of concept: PoC-in-GitHubno public repository identifiedread 2026-11-08
Metasploit modules: none listed

Sources

NVDCVSS 3.17.8read 2026-10-23
CNACVSS 3.07.8known since 2026-10-23
NVDCVSS 2.06.8read 2026-10-23
CNAweakness (CWE)CWE-122known since 2026-10-23
NVDweakness (CWE)CWE-787read 2026-10-23
FIRST EPSSEPSS score3.1 %2026-11-08
OSVaffected packages—
GitHub Advisoriesadvisory—

Identifiers

AZL-9487same flawAzure Linux · MIT
EUVD-2022-24700same flawENISA EUVD · LicenseRef-ENISA-legal-notice
GHSA-pq29-2m6m-938vsame flawGitHub Advisory Database · CC-BY-4.0
MGASA-2022-0203advisory covering several CVEsMageia · LicenseRef-unstated
openSUSE-SU-2024:12051-1advisory covering several CVEsopenSUSE · LicenseRef-unstated
SUSE-SU-2022:2102-1advisory covering several CVEsSUSE · LicenseRef-unstated
SUSE-SU-2022:4619-1advisory covering several CVEsSUSE · LicenseRef-unstated

Technical details

CVSS v3 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: 2022-04-18
Last Modified: 2026-06-17
NVD status: Modified
GitHub Advisory: GHSA-pq29-2m6m-938v

Frequently asked questions

What is CVE-2022-1381?

Is CVE-2022-1381 actively exploited?

Active exploitation of CVE-2022-1381 has not been confirmed. Its EPSS score was 3.1% on 2026-11-08, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2022-1381?

CVE-2022-1381 has a CVSS v3 base score of 7.8 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Running vim? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this product CISA KEV additions, November 2026 Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record

MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CVE records are reproduced under the CVE Program Terms of Use: MITRE grants a perpetual, royalty-free licence to reproduce and redistribute them, provided this designation and the licence travel with every copy. Read the licence

This product uses data from the NVD API but is not endorsed or certified by the NVD.

Sources and licences of the CVE data