Security readout for executives and security teams
Plain-English summary
Vim versions before 9.0.0360 contain a use-after-free memory bug. A user likely must open attacker-controlled content in Vim for impact. If triggered, the published CVSS rating indicates possible compromise of confidentiality, integrity, and availability on the local system.
Executive priority
Treat as a high-priority hygiene fix, especially for engineering and operations systems. It is serious because successful exploitation could affect the local system, but available evidence does not show active exploitation or network-wormable behavior.
Technical view
CVE-2022-3099 is CWE-416 in vim/vim before 9.0.0360. The CVSS vector is local, low complexity, no privileges, user interaction required, with high CIA impact. Upstream fixed it in commit 35d21c6830fc2d68aca838424a0e786821c5891c; Fedora, Debian LTS, and Gentoo issued package updates.
Likely exposure
Exposure is most likely on endpoints, servers, containers, and developer environments running Vim packages older than 9.0.0360 or unpatched distro builds. Risk is higher where users edit untrusted files or receive files from external parties.
Exploitation context
The source bundle does not identify active exploitation, and KEV is false. The vulnerability is local and requires user interaction, so it is not described as remotely reachable by itself. Public vulnerability and fix references exist.
Researcher notes
Focus analysis on Vim builds before 9.0.0360 and distro backports. The public data names CWE-416 and high local impact, but the provided bundle does not include detailed trigger conditions beyond the upstream fix and advisories.
Mitigation direction
- Upgrade Vim to version 9.0.0360 or a vendor-patched package.
- Apply relevant Fedora, Debian LTS, Gentoo, or other distribution security updates.
- Prioritize developer workstations, admin jump boxes, and servers with interactive shell use.
- Reduce use of vulnerable Vim for untrusted files until patched.
- Check vendor guidance if package versioning backports the upstream fix.
Validation and detection
- Inventory installed Vim versions across endpoints, servers, and container images.
- Confirm packages include the fix for CVE-2022-3099 or upstream 9.0.0360.
- Review distribution changelogs or advisories for backported security patches.
- Verify patch deployment through endpoint management or package audit data.
- Retest representative systems after update to confirm Vim launches normally.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-3099 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
7.8HighVector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://huntr.dev/bounties/403210c7-6cc7-4874-8934-b57f88bd4f5eCVE reference
- https://github.com/vim/vim/commit/35d21c6830fc2d68aca838424a0e786821c5891cCVE reference
- FEDORA-2022-b9edf60581CVE reference · vendor-advisory
- FEDORA-2022-3f5099bcc9CVE reference · vendor-advisory
- FEDORA-2022-c28b637883CVE reference · vendor-advisory
- [debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security updateCVE reference · mailing-list
- GLSA-202305-16CVE reference · vendor-advisory
- https://lists.debian.org/debian-lts-announce/2025/03/msg00023.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.