CVE-2022-47024: vim NULL Pointer Dereference
CVSS: 7.8v3.1HighModified
AliasesALPINE-CVE-2022-47024RHSA-2023:0958UBUNTU-CVE-2022-47024DEBIAN-CVE-2022-47024
Published 20-01-2023Last modified 03-04-2025
Vulnerability summary
CVE-2022-47024 is a high (CVSS 7.8) NULL Pointer Dereference vulnerability in vim. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.6% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.1 (CVE.org)EPSS score
0.26%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 20-01-2023PublishedVulnerability first disclosed.
- 03-04-2025Last modifiedVulnerability information updated.
Description
A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
0.00 pp
From 0.26% on 19-09-2026
19-09-202619-10-2026
EPSS score0.26%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat12 products
- vim< 2:8.2.2637-20.el9_1
- vim-common< 2:8.2.2637-20.el9_1
- vim-common-debuginfo< 2:8.2.2637-20.el9_1
- vim-debuginfo< 2:8.2.2637-20.el9_1
- vim-debugsource< 2:8.2.2637-20.el9_1
Alpine1 product
- vim≥ 8.1.2269, < 9.0.0999-r0
Debian1 product
- vim< 2:9.0.0626-1
Ubuntu1 product
- vim< 2:7.4.052-1ubuntu3.1+esm6 | < 2:7.4.1689-3ubuntu1.5+esm15 | < 2:8.0.1453-1ubuntu1.11 | < 2:8.1.2269-1ubuntu5.12 | < 2:8.2.3995-1ubuntu2.4
Vim1 product
- vim≥ 8.1.2269, ≤ 9.0.0339
5 vendors · 16 products
References
16 links- github.com/vim/vim/commit/a63ad78ed31e36dbdf3a9cd28071dcdbefce7d19ARTICLEREPORTPatchThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- security.gentoo.org/glsa/202305-16Vendor Advisory
