CVE-2022-4141: Debian Linux

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 36 only; version 37 only
• Neovim Neovim: from 0.1.0, before 0.10.0 (fixed in 0.10.0)
• Vim Vim: up to and including 9.0.0946

Published 2022-11-25. Last modified 2026-09-24.