CVE-2024-22667 – CVE-2024-22667 is a stack-based buffer overflow... (How to Fix)

Q: What is the severity of CVE-2024-22667?

CVE-2024-22667 has a CVSS score of 7.8 (HIGH). CVE-2024-22667 is a stack-based buffer overflow vulnerability in Vim's map.c file where the did_set_langmap function uses sprintf to write to an error buffer, potentially allowing arbitrary code execution. This affects users running Vim versions before 9.0.2142. Attackers could exploit this by tricking users into opening malicious files or using crafted language map configurations.

📋 TL;DR

CVE-2024-22667 is a stack-based buffer overflow vulnerability in Vim's map.c file where the did_set_langmap function uses sprintf to write to an error buffer, potentially allowing arbitrary code execution. This affects users running Vim versions before 9.0.2142. Attackers could exploit this by tricking users into opening malicious files or using crafted language map configurations.

💻 Affected Systems

Products:

Vim

Versions: All versions before 9.0.2142

Operating Systems: Linux, Unix-like systems, Windows (if Vim is installed)

Default Config Vulnerable: ⚠️ Yes

Notes: All standard Vim installations with affected versions are vulnerable. The vulnerability is triggered through language map functionality.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with the privileges of the Vim user, potentially leading to full system compromise if Vim is run with elevated privileges.

🟠

Likely Case

Local privilege escalation or arbitrary code execution when users open malicious files or use crafted language map configurations.

🟢

If Mitigated

Denial of service or application crash if exploit attempts fail or are blocked by security controls.

🌐 Internet-Facing: LOW - Vim is typically not directly internet-facing, though could be exploited through web interfaces or file uploads.

🏢 Internal Only: MEDIUM - Internal users could be targeted via malicious files or configurations, especially in shared environments.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Proof of concept code is publicly available in the GitHub gist reference. Exploitation requires user interaction (opening files or using language maps).

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 9.0.2142 and later

Vendor Advisory: https://github.com/vim/vim/commit/b39b240c386a5a29241415541f1c99e2e6b8ce47

Restart Required: No

Instructions:

1. Update Vim to version 9.0.2142 or later using your system's package manager. 2. For Linux: Use 'sudo apt update && sudo apt upgrade vim' (Debian/Ubuntu) or 'sudo yum update vim' (RHEL/CentOS). 3. For source installations: Download latest source from vim.org and compile.

🔧 Temporary Workarounds

Disable language map functionality

all

Prevents triggering the vulnerable code path by disabling language map support

Add 'set nolangmap' to your .vimrc file

Restrict Vim usage

linux

Limit Vim usage to trusted users and environments

Use apparmor/selinux profiles to restrict Vim
Implement least privilege for Vim users

🧯 If You Can't Patch

Implement strict file handling policies - only open files from trusted sources
Use alternative text editors until patching is possible

🔍 How to Verify

Check if Vulnerable:

Run 'vim --version' and check if version is below 9.0.2142

Check Version:

vim --version | head -1

Verify Fix Applied:

Run 'vim --version' and confirm version is 9.0.2142 or higher

📡 Detection & Monitoring

Log Indicators:

Vim crash logs
Segmentation fault errors in system logs
Unusual process spawning from Vim

Network Indicators:

Unusual file transfers initiated by Vim process
Outbound connections from Vim

SIEM Query:

process_name:vim AND (event_type:crash OR exit_code:139 OR exit_code:11)

📊 Metadata

CVE ID: CVE-2024-22667

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: February 5, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-22667, you might also want to check these: